tracking(permissions): finish macOS Stage 2

## Problem

Stage 1 of macOS drag-to-grant onboarding shipped in #1515, but the card still
anchors to the cursor on `main`. Stage 2 requires foreign-window location,
docking, packaged delivery, and end-to-end validation; those completion
requirements have no issue tracker.

Open PR #1532 implements most of the locator/docking path, but it is currently
merge-conflicted, explicitly excludes signing/notarization, and has not verified
the composed flow on a machine with clean TCC state. This issue tracks the
outcome rather than duplicating that implementation.

## Completed baseline

- Stage 1 provides a non-focus-stealing panel, cross-process app drag, grant polling, localized fallback/restart copy, re-entry protection, and bounded teardown.
- #1532 adds a CoreGraphics locator, top-left coordinates, multi-display docking, failure classification, reduced-motion-aware flight geometry, and focused tests.

## Remaining work

- [ ] Rebase and land #1532 without regressing current permission-overlay fixes
- [ ] Package the universal locator binary and integrate signing/notarization and packaged-resource verification
- [ ] Verify the composed flow on clean Accessibility and Screen Recording states in a packaged app
- [ ] Cover an off-centre and moved Settings window, negative-origin displays, locator fallback, and Settings-close teardown
- [ ] Preserve the Stage 1 cursor anchor and loud diagnostic fallback when docking evidence is unavailable

## Non-goals

- Circumventing macOS consent or writing TCC state
- Using Accessibility/System Events to locate System Settings
- General settings automation or a reusable foreign-window controller

## Design

- [Drag-to-grant permission onboarding](https://github.com/apache/maka/blob/main/docs/permission-onboarding-plan.md)
- Stage 1: #1515
- Partial Stage 2 implementation: #1532

Start with docs/permission-onboarding-plan.md, Stage 1 issue #1515, and the partial implementation in PR #1532. Review its focused tests and merge-conflict state before checking the remaining packaging, signing, clean-TCC validation, window-position cases, fallback, and teardown requirements. Done means the composed packaged Stage 2 flow passes without regressing Stage 1 behavior.

Written by the indexing model from the issue text.