[hideouts-io]

Summary

• Prepare the selected IPA or app bundle in a private copy, inspect it, and revalidate the original and prepared bytes before installation. Confirmation captures the package, target, and developer-package option; malformed, changed, or unsupported packages cannot start installation.
• Run asynchronous package preparation and IPA inspection on a dedicated Dispatch queue. Hosted process samples showed two Swift cooperative workers blocked in native signature validation. The app, CLI, and signing integration tests now await the queue while preserving all-architecture, strict, and nested-code validation.
• Carry cancellation through preparation's file-enumeration and hashing checkpoints. Pending cancelled work is skipped; in-flight native validation retains ownership until it returns, and a completed private copy is removed before late cancellation is reported. AFC staging failures and cleanup failures remain explicit.
• Keep the owned-command cancellation fixture responsive to SIGTERM while retaining its release-barrier and child-exit assertions.

Verification

At commit 681bc3e112cc0ffb4190f2be2f5bde29cc9ad387:

• swift build --build-tests -j 4 -Xswiftc -warnings-as-errors passed.
• Focused package-preparation and IPA-inspection integration tests passed: 19 tests, including concurrent signed inspection/preparation, tampering rejection, and a pre-cancelled preparation.
• swift test --parallel -j 4 -Xswiftc -warnings-as-errors --quiet and swift test -j 4 -Xswiftc -warnings-as-errors --quiet both passed all 277 tests. Opt-in simulator and physical-device suites were skipped locally.
• The project-configured headless xcodebuild ... build-for-testing passed for the app and UI-test bundles. The documented global SWIFT_TREAT_WARNINGS_AS_ERRORS=YES override fails in SwiftNIO targets because their suppress-warnings flag conflicts with warnings-as-errors.
• Required CI passed at this commit: the original unfiltered swift test -Xswiftc -warnings-as-errors passed 277 tests in 42 suites in 14.040 seconds, CLI smoke passed, all 16 UI tests and layout checks passed, both real simulator tests passed, and release packaging passed. Dependency review passed.
• Swift and Actions CodeQL, the extraction-error gate, both uploads, and the aggregate gate passed at this commit. Swift SARIF reports no extraction-error notifications and zero unresolved AST nodes. All five changed production Swift files were extracted. Successful-extraction notifications cover 106/131 Swift files under Sources/App/Tests (79/79, 24/25, 3/27); these counts do not establish complete imported-module semantics.

Remaining validation

This PR remains draft pending controlled native confirmation and quit acceptance, plus physical signing, provisioning, and installation evidence. Native signature validation itself cannot be interrupted; cancellation waits for its return and cleanup. Physical-device operations and release publication are outside this change.