docs(macos): sandboxed vs non-sandboxed builds and the minimum macOS version #1591

Problem

The shipped macOS app is one of two different programs depending on CI secrets:

• Signed builds use ReleaseSigned.entitlements: no App Sandbox, hardened runtime.
• Without MACOS_* secrets (forks, local flutter build macos) the Xcode project's Release.entitlements applies: App Sandbox on, only network.client/server and files.user-selected.read-write.

In the sandboxed build ~/.querya, extension processes (sandbox-exec inside a sandbox), in-place updates into /Applications, the MCP socket and previously chosen SQLite file paths (no security-scoped bookmarks) do not behave like the signed build. docs/macos-signing.md mentions it; README and the contributor docs do not.

Also MACOSX_DEPLOYMENT_TARGET = 10.15 in all configurations while the docs target macOS 14+ for ProMotion; the minimum is not checked against the plugins' requirements.

Tasks

• Decide: ship the unsigned build without the sandbox too, or document the limitations in README / CONTRIBUTING.
• Align and document the minimum macOS version.