tracking(permissions): finish macOS Stage 2

[Phoenix500526]

Problem

Stage 1 of macOS drag-to-grant onboarding shipped in #1515, but the card still
anchors to the cursor on main. Stage 2 requires foreign-window location,
docking, packaged delivery, and end-to-end validation; those completion
requirements have no issue tracker.

Open PR #1532 implements most of the locator/docking path, but it is currently
merge-conflicted, explicitly excludes signing/notarization, and has not verified
the composed flow on a machine with clean TCC state. This issue tracks the
outcome rather than duplicating that implementation.

Completed baseline

• Stage 1 provides a non-focus-stealing panel, cross-process app drag, grant polling, localized fallback/restart copy, re-entry protection, and bounded teardown.
• feat(permissions): dock the drag-to-grant card to the Settings window #1532 adds a CoreGraphics locator, top-left coordinates, multi-display docking, failure classification, reduced-motion-aware flight geometry, and focused tests.

Remaining work

• Rebase and land feat(permissions): dock the drag-to-grant card to the Settings window #1532 without regressing current permission-overlay fixes
• Package the universal locator binary and integrate signing/notarization and packaged-resource verification
• Verify the composed flow on clean Accessibility and Screen Recording states in a packaged app
• Cover an off-centre and moved Settings window, negative-origin displays, locator fallback, and Settings-close teardown
• Preserve the Stage 1 cursor anchor and loud diagnostic fallback when docking evidence is unavailable

Non-goals

• Circumventing macOS consent or writing TCC state
• Using Accessibility/System Events to locate System Settings
• General settings automation or a reusable foreign-window controller

Design

• Drag-to-grant permission onboarding
• Stage 1: feat(permissions): drag-to-grant onboarding for macOS TCC (Stage 1) #1515
• Partial Stage 2 implementation: feat(permissions): dock the drag-to-grant card to the Settings window #1532