Fix import and API security issues and add release checks

[estout82]

A fresh clone did not compile without the optional ProPresenter types. The Local API also kept revoked WebSocket sessions authorized and allowed read-only clients to fetch stream presets containing ingest credentials. PowerPoint XML could resolve local-file entities, and extracted import archives accepted symbolic links.

This change restores the SDK-free build, closes those import and API access paths with regression coverage, redacts streaming URLs/errors from public logs, and makes the app/helper/Keychain identifiers follow the selected production bundle ID. It adds pinned app dependencies, CI, dependency-update configuration, and license bundling for distribution. CONTRIBUTING.md and SECURITY.md are intentionally omitted as requested.

Validation:

• All 12 Swift package suites passed on Apple silicon with Xcode 26.6; four streaming tests initially skipped because external loopback services were unavailable. The three HLS loopback tests subsequently passed against the local test sink; RTMP loopback remains unverified.
• Re-ran the updated LocalAPI (34 tests), PowerPoint importer (84 tests), and StreamEngine suites; generated ProPresenter import types and passed all 110 full importer tests.
• Debug app build passed, including a custom bundle ID with matching helper identifiers. The final rebuild with import hardening also passed.
• Schema generation is clean; 50 diagnostic/performance-script assertions pass; workflow syntax, release dependency gates, and license-bundle checks pass.
• Gitleaks 8.30.1 found no secrets in the complete Git history or the changes.

This PR remains a draft because binary distribution is not approved: HaishinKit 2.2.5's SRT artifact embeds unsupported OpenSSL 3.3.2, so the release script now blocks that dependency. A maintained upstream SRT package exists, but adopting HaishinKit's newer integration involves unreleased upstream changes and still needs SRT receiver validation. Production signing/notarization, SDK redistribution review, physical NDI/DeckLink checks, and macOS 14 runtime testing also remain. See docs/RELEASING.md. Repository visibility is unchanged.