feat: namespace known folders by Mac name

[OpenCow42]

Summary

• resolve or create Desktop and Documents beneath Private/
• sanitize and length-limit Mac names while failing closed on remote collisions
• preserve active legacy Private claims and upgrade inactive domains without moving remote data
• update the drive-management UI, persistence migration, documentation, and focused tests

Validation

• macOS potassiumProviderTests target passed
• focused KnownFolderLifecycleTests and KDriveMachineNamespaceResolverTests passed
• iPhone 17 simulator build passed on iOS 26.5
• unsigned generic visionOS build passed
• signed visionOS validation is locally blocked because the installed wildcard profile lacks the App Group entitlement

Closes #10