P2: Guided macOS permission onboarding for Workbench Mac control

[100yenadmin]

Mac permission onboarding follow-up split from #362.

Scope:

• Keep pairing recovery focused on Mac pairing/control proof first.
• Use zats/permiso as UX reference only; do not vendor directly unless license and macOS compatibility are cleared. Current read-only check found no license file and the package targets newer macOS assumptions.
• Build an evaOS-owned permission guide later: Accessibility and Screen Recording deep links, drag-and-drop app row guidance, clear return-to-Workbench copy, and no legacy app confusion.

Acceptance:

• Users can understand which app/helper needs Accessibility and Screen Recording.
• Permission prompt/recheck flow works without repeated confusing popups.
• Does not alter connector pairing/security contract.

Not a blocker for the immediate Mac pairing P0 unless permissions actually regress and block proof.

[100yenadmin]

Status after release-planning cleanup: keep open as a post-RC permission-onboarding UX follow-up. Useful, but not a blocker for the direct Mac-control private RC.

Planning packet: #480 (comment)

Boundary: this status does not claim public/customer release readiness.

[100yenadmin]

Moving this out of the shipped v2.1.27 TryCUA Mac Control milestone.

The v2.1.27 release shipped the direct CUA/TryCUA Mac-control engine priority path. Guided macOS permission onboarding is still useful product polish, but it is not a blocker for the shipped release and should remain in a later native-companion/support-polish lane.