[codex] Add Owner Lifetime license foundation

[uniplanck]

Summary

• Adds central Owner Lifetime entitlement support without issuing a usable owner token.
• Removes the prior local founder-code activation bypass so activation remains future signed-token work.
• Documents the secure future activation path and forbidden shortcuts.

Files changed

• Clipy/Sources/Services/Entitlement.swift
• Clipy/Sources/Services/LicenseToken.swift
• Clipy/Sources/Services/LicenseActivationClient.swift
• Clipy/Sources/Managers/MenuManager.swift
• Clipy/Sources/Preferences/Panels/CPYBetaPreferenceViewController.swift
• ClipyTests/EntitlementGateTests.swift
• docs/boardman-owner-license-foundation.md

Entitlement changes

• Adds ownerLifetime to the central LicenseState and Plan model.
• Treats Owner Lifetime as Pro-or-better only through Entitlement.isProEntitled and EntitlementGate.
• Preserves Free default behavior.

Token/storage/UI support

• Extends signed token payload parsing with license kind, issued subject, lifetime flag, and existing device/bundle placeholders.
• Adds a narrow future Keychain token storage interface that does not store or unlock anything yet.
• Keeps activation disabled/not configured and removes local founder-code activation.
• Updates License UI summaries to display Owner Lifetime only when the central entitlement state is present.

Validation results

• git status --short: clean except pre-existing untracked _copy/
• git diff --stat: reviewed
• git diff --check: passed
• Generic build initially failed after adding the enum because existing switch statements needed ownerLifetime cases; fixed.
• rtk xcodebuild -project Board-Man.xcodeproj -scheme Board-Man -configuration Debug -derivedDataPath "${TMPDIR:-/tmp}/BoardManCodexValidation" -destination 'generic/platform=macOS' -skipPackagePluginValidation -skipMacroValidation CODE_SIGNING_ALLOWED=NO build: passed

Explicitly out of scope

• real token issuance
• private key generation
• backend activation
• production license API
• purchase flow
• release/appcast
• hardcoded owner bypass
• UserDefaults/local JSON/email/device-name Pro bypass

[uniplanck]

Superseded by #81, which includes the Owner Lifetime foundation together with the UI, stable install, and Keychain prompt fixes.