feat(packaging): add restricted Sender control helper

[Betafer]

Summary

• add a restricted helper for starting, stopping and reconfiguring the headless Sender
• whitelist only activate, stop, path selection and optional input-control commands
• keep the existing lifecycle enabled marker as the source of truth
• update requested path/input atomically with private permissions
• avoid reconnecting when an input preference is changed while monitor mode is stopped
• preserve the registered LaunchAgent instead of removing it on Stop

Safety

• unknown commands fail before any state change
• activation requires the intended user to own the active console session
• process matching escapes the executable path before using it as a regular expression
• missing installation and launchd failures return stable actionable status codes
• the helper is suitable for use as an SSH forced command; it does not itself modify SSH configuration

Validation

• shell syntax checks pass for the helper and mocks
• 26 isolated checks pass
• covers activation, repeated activation, path changes, input on/off, persistent Stop, restart after Stop, forbidden commands, wrong login, missing installation and launchd bootstrap failure

This PR adds only the restricted control helper and its tests. LaunchAgent/SSH installation remains a separate packaging concern.