feat: entitlements.py — security & ATS audit

[conorluddy]

Problem

App Store rejections from missing NS*UsageDescription strings, weak ATS configs, or improper entitlements are preventable but go unchecked until submission day.

Sketch

python scripts/entitlements.py --bundle path/to/MyApp.app
python scripts/entitlements.py --bundle MyApp.app --check-ats
python scripts/entitlements.py --bundle MyApp.app --rejection-risks

Output reports declared entitlements, ATS dictionary, all NS*UsageDescription strings, and flags common rejection causes (e.g. missing usage description for a declared entitlement, NSAllowsArbitraryLoads=YES).

Reuses

• plistlib for Info.plist parsing
• subprocess.run(["codesign", "-d", "--entitlements", "-", ...]) for entitlements
• Standard class-based pattern

Open questions

• Source of truth: built .app bundle vs Xcode project file? (Built bundle is more accurate — reflects merged Info.plist.)
• Should we crosscheck against Privacy Manifest (PrivacyInfo.xcprivacy)?

Definition of done

• Entitlements + ATS + usage strings extracted
• At least 5 common rejection causes detected
• --json, --help, SKILL.md updated

Part of the v2.0 coverage expansion epic.