fix: disable sandbox for ~/.claude access, add path input field for hidden folders

- Remove App Sandbox from Release entitlements (developer tool needs
  filesystem access to ~/.claude/projects — same as VS Code, iTerm2)
- Explicitly set get-task-allow=false in entitlements for notarization
- Add path input field in header so users can type paths with hidden
  folders (e.g. ~/.claude/projects) — press Enter or click arrow to scan
- Field pre-populated with ~/.claude/projects on launch
- Signed, notarized, stapled DMG

macos/Runner.xcodeproj/project.pbxproj

@@ -724,6 +724,7 @@
 				CODE_SIGN_STYLE = Manual;
 				"DEVELOPMENT_TEAM[sdk=macosx*]" = LD76P8L42W;
 				ENABLE_HARDENED_RUNTIME = YES;
+				CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION = YES;
 				OTHER_CODE_SIGN_FLAGS = "--timestamp --options runtime";
 				COMBINE_HIDPI_IMAGES = YES;
 				INFOPLIST_FILE = Runner/Info.plist;

macos/Runner/Release.entitlements

@@ -2,11 +2,7 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>com.apple.security.app-sandbox</key>
-	<true/>
-	<key>com.apple.security.files.user-selected.read-only</key>
-	<true/>
-	<key>com.apple.security.files.home-directory.read-only</key>
-	<true/>
+<key>com.apple.security.get-task-allow</key>
+<false/>
 </dict>
 </plist>