Mac TCC: the agent's per-binary permissions are unproven since the rewrite

open   by a73x

Labels: backlog

[claude 2026-08-18] Carried in notes as #21, parked because it needs Squirtle.local,
which has been offline since before v0.0.6. macOS grants TCC permissions per binary,
so an upgraded eitri-agent can lose the approvals the previous binary held. Nothing
in the upgrade path accounts for it and nothing tests it.
Blocked on hardware: resume when Squirtle is back on the fleet.