Consolidate App Store entitlement contracts

[cbusillo]

Summary

• consolidate duplicated app and refresh-agent App Store entitlement assertions into one canonical helper
• keep separate top-level tests so plist failures remain isolated
• strengthen the dedicated refresh-agent test with the existing no-network-server contract

Refs #578

Validation

• swift test --filter appStoreEntitlementsSupportSandboxed (2 passed)
• python3 scripts/context-panel-test-lanes.py time-command --lane routine-ci-swift -- swift test (889 passed)
• scripts/commit-gate.sh
• two-direction mutation proof: app-only network.server mutation failed only the app test; agent-only mutation failed only the agent test
• Opus and Gemini exact-SHA final reviews approved 3b6570c

Inspection

• JetBrains changed-files inspection reported 74 pre-existing spell-check findings on product identifiers such as shinycomputers and contextpanel; no semantic Swift finding was surfaced and execution proof was unavailable.