fix: capture process identity in macOS sandboxes

[janicduplessis]

Description

macOS process capture fails in the Codex workspace sandbox: reading the PID and exact start time succeeds, but the boot-session query returns EPERM. Fixes #2.

Solution

Allow new macOS tokens to omit boot identity when access is denied, retaining the exact microsecond start timestamp. Tokens already carrying a boot ID still require it to match. If the start timestamp matches, inability to verify the saved boot ID returns ACCESS_DENIED.

Without boot identity, a repeated PID and exact timestamp after a reboot or clock reset cannot be distinguished. This relaxes the original boot-ID requirement to allow restricted captures; the limitation is documented. Linux and Windows identity requirements are unchanged. Prepares 0.1.1.

Test plan

• Verified capture, serialization, fresh-reader matching, and exited-child detection inside the actual Codex sandbox.
• On macOS, npm run build && npm run test:sandbox exercises denied boot queries, both sandbox-boundary directions, denied process inspection, and denied ps execution.
• Installed-package smoke test passes with install scripts disabled. CI builds and tests all six OS/architecture combinations before release.

[janicduplessis]

Fresh independent safety review completed for 0398667: no actionable code findings. Real sandbox and ordinary identity tests passed; clarified the description to distinguish a proven timestamp mismatch from an unverifiable saved boot ID.