Refresh companion widget from iCloud

[shiny-code-bot]

Summary

• make the companion widget load through the same local+iCloud mirror selection path as the companion app, so a stale app-group mirror can refresh from the iCloud sync document
• add iCloud Documents entitlements to the companion widget and guard them in release entitlement tests
• remove the confusing "read-only companion" sync-current copy from limited/close statuses
• make local install/reset fail before building if Google OAuth debug credentials are missing or partial
• preflight iCloud Documents authorization on both companion app and widget App Store provisioning profiles

Validation

• python3 -m unittest Tests.ScriptsTests.test_release_workflows
• bash -n scripts/context-panel-runtime-baseline.sh scripts/validate-companion-builds.sh scripts/upload-app-store-connect-companion-app.sh
• swift test --filter companionWidgetLoaderRefreshesStaleMirrorFromICloudDocument
• swift test --filter companionEntitlementsMirrorICloudIntoIOSSuite
• scripts/validate-companion-builds.sh
• git diff --check
• scripts/commit-gate.sh (301 Swift tests)
• review agents: GPT, Claude, and Antigravity no blockers after widget profile preflight fix

Notes

• JetBrains changed-file inspection was attempted twice, including foreground open, but IntelliJ had the root checkout open and the helper timed out before it could open the exact linked worktree. I did not treat the root checkout as valid inspection evidence for this branch.

Refs #168
Refs #174