Rearchitect transactional generation and installation

[lynnswap]

Purpose

Complete the unfinished PrivateHeaderKit rewrite by assigning generation state, artifact publication, process lifecycle, and installation to explicit owners.

The previous implementation split state across JSON files, repositories, generated artifacts, CLI control flow, and mutable install locations. That made interruption recovery, cross-process coordination, and atomic upgrades ambiguous.

Changes

• Replace the fragmented generation state path with a GRDB-backed actor store and monotonic state sequencing.
• Publish immutable generations through atomic pointers, with explicit intent and recovery for filesystem and database boundaries.
• Rebuild the CLI with swift-argument-parser and typed Core results.
• Replace Foundation.Process wrappers with swift-subprocess, structured process-group teardown, cancellable output draining, and root-owned signal handling.
• Install immutable version cohorts with atomic current switching, durable legacy migration recovery, release manifests, and checksum verification.
• Add release build, package, installer rendering, and artifact verification workflows.
• Remove obsolete state repositories, subprocess helpers, and unused file-operation layers.
• Document the selected persistence, concurrency, installer, and recovery contracts.

Testing

• Full Swift test suite: 230 tests across 30 suites passed.
• Release products built successfully.
• Release archive, checksum, temporary-prefix installation, active cohort selection, and tamper rejection smoke tests passed.
• Shell scripts passed syntax validation.
• GitHub Actions workflow passed actionlint v1.7.12.
• Final full-diff Codex review reported no actionable findings.