fix(cua-driver): accept host identity in embedded health check

[injaneity]

Summary

• make the macOS health_report bundle identity check aware of embedded mode
• resolve the embedded daemon's direct parent through macOS instead of trusting CUA_DRIVER_EMBEDDED=1 alone
• fail closed when the parent is not an identifiable application or its bundle identifier differs from CUA_DRIVER_HOST_BUNDLE_ID
• expose the observed identity, configured identity, identity source, executable, and responsible parent PID in structured check data
• retain the existing failure and CuaDriver.app remediation for non-embedded raw binaries
• add regression coverage for matching, missing, and mismatched embedded hosts
• extend the real macOS host harness to assert health_report identity data and host/driver TCC parity together

Why

Embedded mode intentionally keeps cua-driver in its host application's TCC responsibility chain. The existing bundle_identity health check required com.trycua.driver, so a correctly embedded driver was reported as degraded and received remediation that would break host attribution.

The initial fix trusted the embedded-mode environment flag. This revision addresses the review concern by observing the actual parent macOS application and comparing it with the configured host identity. A shell or gateway launch can no longer pass the check merely by setting the flag.

Closes #2102.
Supersedes and closes #1914.

Verification

• Rust formatting passes on macOS, Linux, and Windows CI
• workspace metadata and git diff --check pass locally
• the documented Swift host example matches the executable harness byte-for-byte
• unit coverage exercises observed-host success, missing-host failure, and configured-host mismatch failure
• the updated ExampleAgentHarness.app requires all of the following for a pass:
  • bundle_identity.status == "pass"
  • observed host bundle identifier equals Bundle.main.bundleIdentifier
  • identity source is parent_application
  • reported responsible parent PID equals the host process PID
  • driver Accessibility and Screen Recording booleans match the host's own probes
  • inherited AX and screen-capture operations succeed

Remaining manual evidence

Run libs/cua-driver/rust/examples/embedded-host-macos/demo.sh in a logged-in macOS session with the relevant TCC grants and attach the resulting PASS log. GitHub-hosted runners can compile and test the code, but they cannot provide an interactive, persisted TCC approval session.

[f-trycua]

The exact head compiles and the identity branch is unit-covered, but the host/TCC behavior is not yet demonstrated. Before approval, please compare public health_report output from the standalone CuaDriver app and a real embedded macOS host in a logged-in session, asserting identity status and data as well as the process to which TCC permission is actually attributed. The release-metadata check also needs to pass.