fix: address agentd backlog feedback

[haasonsaas]

Summary

• add a typed EvalOpsContextMetadata helper for canonical evalops.context.v1 metadata cleanup and Secret Broker metadata construction
• harden local batch persistence/replay so failed local writes return failed, pipeline batches remain pending for retry, and replay no longer runs retention sweeps between queued files
• fix packaging/release feedback: explicit CFBundleExecutable, regenerate notarized zip after stapling, boolean notarized metadata, artifact-root checksums, and permission smoke authority parsing
• tighten secret scrub patterns for modern OpenAI keys and Discord false positives; correct heartbeat pending-frame accounting and remove duplicate policy reconcile refreshes

Backlog / feedback covered

• Fixes Adopt shared evalops.context.v1 metadata helper #47
• Addresses Run Developer ID notarization for packaged agentd app #24 and Smoke test Screen Recording and Accessibility permission flow #25 packaging/smoke tooling defects; credentialed notarization and interactive TCC validation still require release credentials + desktop session
• Partially addresses chronicle: gap analysis & follow-ups vs. OpenAI Codex Chronicle (binary archaeology) #39/capture: add multi-display observability and adaptive OCR budgets #34 follow-ups by cleaning heartbeat accounting and related safety rails
• Covers merged-PR review feedback from Address agentd open issue backlog #21, Add hardened app packaging #23, Add notarized release packaging workflow #26, Add permission smoke helper #27, [codex] Add managed Chronicle heartbeat policy sync #37, [codex] Encrypt local batch fallback files #38, and [codex] Harden diagnostics, pause policy, and contract drift gates #40

Validation

• swift test
• swift build -Xswiftc -warnings-as-errors
• xcrun swift-format lint --strict --recursive Sources Tests Package.swift
• python3 scripts/mock_chronicle.py --self-test Tests/Fixtures/chronicle
• shellcheck scripts/package_app.sh scripts/permission_smoke.sh
• actionlint .github/workflows/package-release.yml
• scripts/package_app.sh
• scripts/permission_smoke.sh --no-launch
• git diff --check

[cursor]

PR Summary

^{Cursor Bugbot is generating a summary for commit c47f483. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit c47f483. Configure here.}