Adds DOWNLOADING_ASSETS phase, docker_tools_installed field, and
GetSetupStatus/WatchSetupStatus RPC methods.

…Manager

These responsibilities are now handled by the daemon:
- Boot assets: auto-provisioned during daemon startup
- Docker CLI tools: installed during daemon recovery phase
- CLI runner: no longer needed, desktop doesn't shell out

DaemonManager: Replace /_ping polling with WatchSetupStatus gRPC stream.
Daemon liveness is now derived from stream connectivity. Setup phase,
infrastructure flags, and status messages are all pushed by the daemon.

StartupOrchestrator: Reduce to 2 steps (enableDaemon + connectAndWatch).
All provisioning (boot assets, runtime binaries, Docker tools) is handled
by the daemon.

ArcBoxApp: Remove BootAssetManager, DockerToolSetupManager state.
Orchestrator init simplified to daemonManager + onClientsNeeded.

Register the privileged helper as a system-level LaunchDaemon using
SMAppService.daemon(). macOS handles the authorization prompt natively
(password / Touch ID). This eliminates the need for desktop users to
run `abctl install`.

Startup sequence is now 3 steps:
1. installHelper — SMAppService.daemon() (one-time, non-critical)
2. enableDaemon — SMAppService.agent()
3. connectAndWatch — gRPC WatchSetupStatus stream

The helper plist uses BundleProgram to reference the binary embedded
in the app bundle at Contents/Library/HelperTools/ArcBoxHelper.

Makefile wraps the existing package-dmg.sh with dependency targets:
  make build-rust  — cargo build release
  make prefetch    — download boot assets + Docker tools
  make dmg         — unsigned DMG (local testing)
  make dmg-signed  — Developer ID signed DMG

Also creates the helper LaunchDaemon plist template for
SMAppService.daemon() registration (BundleProgram format).

Replace inline prefetch/build-dmg steps with `make prefetch` and
`make dmg-release`. Build logic lives in one place (Makefile +
package-dmg.sh); the workflow only handles CI-specific concerns
(secrets, artifact upload, Sparkle signing).

Local dev and CI now share the exact same build path:
  Local:  make dmg-signed
  CI:     make dmg-release SIGN_IDENTITY="..." NOTARIZE=1

The Swift ArcBoxHelper was replaced by the Rust arcbox-helper in v0.3.0
but the Xcode target and build configurations were left behind. This
removes all remnants:
- ArcBoxHelper native target + build configurations
- Copy Helper Tool build phase (referenced Swift target product)
- Target dependency from ArcBox → ArcBoxHelper
- Product reference in Products group

The Rust helper binary is embedded by fetch-arcbox-binaries.sh and
registered via SMAppService.daemon() at runtime. The Generate Helper
LaunchDaemon Plist build phase is preserved (it processes the plist
template for the Rust helper).

DaemonManager.dockerSocketPath was removed when stripping the polling
logic. Inline the path directly since it's a fixed convention.

Copy Rust arcbox-helper binary to Contents/Library/HelperTools/ with
reverse-DNS name matching the plist Label, consistent with the daemon
naming convention. Fix BundleProgram path in helper plist.

build-rust now runs `make build-agent` (aarch64-unknown-linux-musl)
so the Linux guest agent binary is available for bundle embedding.
Without this, package-dmg.sh embeds a macOS binary that the guest
VM can't execute.

gRPC no longer restarts mid-boot, so 30s timeout is sufficient.
Reconnect backoff reduced to 500ms for faster recovery if the
daemon restarts.

Replace SMAppService.daemon() with osascript admin password prompt.
SMAppService.daemon() is unreliable on macOS 15 — it registers the
helper as disabled without notifying the user, and System Settings
provides no separate toggle to enable it (see hyperium/tonic#742,
hyperium/h2#487, Apple FB13206906).

The new approach runs `abctl _install --no-daemon --no-shell` via
osascript's 'with administrator privileges', which triggers the
standard macOS password dialog. Only prompts on first install;
subsequent launches detect the helper socket and skip silently.

Also fix gRPC Unix socket connectivity:
- Switch from Posix to TransportServices transport
- Set http2.authority = "arcbox.local" to avoid RST_STREAM caused
  by grpc-swift sending the percent-encoded socket path as :authority

SMAppService.daemon() is unreliable on macOS 15 — it registers the
helper as disabled in BTM without notifying the user, and System
Settings provides no separate toggle to enable it.

Replace with osascript 'do shell script ... with administrator
privileges' calling `abctl _install --helper-path <bundle-path>`.
This triggers the standard macOS password dialog on first launch only.

Changes:
- DaemonManager: osascript-based installHelper(), checks socket existence
- install.rs: add --helper-path flag for custom helper binary location
- fetch-arcbox-binaries.sh: copy helper to MacOS/bin/ (next to abctl)
- Remove SMAppService.daemon() infrastructure:
  - LaunchDaemons/com.arcboxlabs.desktop.helper.plist
  - Xcode "Generate Helper LaunchDaemon Plist" build phase
  - HelperTools copy in fetch-arcbox-binaries.sh

Paths with spaces (e.g. "ArcBox Desktop.app") were not properly
escaped in the do shell script command. Use single-quote wrapping
instead of backslash escaping.

…ice implementation)

Compare installed vs bundled helper version using `--version` output
instead of SHA256 hashing. On app update, if the bundled helper has
a newer version, re-run _install with admin prompt. Uses existing
Cargo version infrastructure (env!("CARGO_PKG_VERSION")), no build-time
preparation needed.