Mac App Store Review Compliance

## Overview

Tracks all work needed to pass Apple App Store Review for the macOS desktop client. The already-known blocker (QtWebEngine removal) is tracked separately.

## Already Compliant ✅

These items were audited against the current master release build (`/Applications/Nextcloud.app`) and require no changes:

- **App Sandbox** enabled on all four targets (`com.apple.security.app-sandbox: true`)
- **Security-scoped bookmarks** used for persistent folder access
- `startAccessingSecurityScopedResource` / `stopAccessing` properly paired
- **`get-task-allow` absent** from the Release build — `CMAKE_BUILD_TYPE` guard works correctly
- **Crash logging** writes locally to `$TMPDIR` — no remote transmission
- **No privileged helper** (`SMJobBless` or similar)
- **No hardcoded system paths** in production code
- **`LC_BUILD_VERSION`** (modern SDK) used, not legacy `LC_VERSION_MIN_MACOSX`
- **Minimum OS 13.0** declared — satisfies current App Store requirements
- **App Group IDs** consistently templated with `$(DEVELOPMENT_TEAM).$(OC_APPLICATION_REV_DOMAIN)`