fix(macos): disabled Copy menu item; Seatbelt scratch path not canonicalised #1590

Problems

1. Copy menu item is disabled. In lib/features/macos/querya_platform_menu_bar.dart Copy is const PlatformMenuItem(label: 'Copy', shortcut: ...) with no onSelected, which Flutter renders as a disabled item. Cut / Paste / Select All call Actions.maybeInvoke. Cmd+C may not work reliably while a text field is focused.
2. Seatbelt scratch path is not canonical. SandboxScratchDirectory uses Directory.systemTemp (/var/folders/...); /var is a symlink to /private/var, and Seatbelt subpath matches the resolved path, so (allow file-write* (subpath "<scratch>")) likely never matches and the extension cannot write to its scratch dir.
3. Seatbelt profile is looser than documented (buildMacOsSeatbeltProfile): (allow mach-lookup), (allow process*) and (allow file-read*) outside /Users, and scratchPath / extensionRoot are interpolated into the profile without escaping quotes (see also fix(extensions): manifest id is not validated and is used as a path with recursive delete (path traversal) #1560).

Tasks

• Copy: add an onSelected using CopySelectionTextIntent.
• Resolve symlinks for scratch and extension roots before building the profile; add a test with a /var path.
• Narrow mach-lookup / process*, escape profile strings.

Items 1–2 need confirmation on a real Mac.