iris-gui: App Store polish — keyboard capture, sandbox CHD fold, lice…

[danifunker]

…nses, UI fixes

This PR only affects GUI components and adds the GPL3 license file for CHD license compliance.

Keyboard capture (input.rs):

• Lock the framebuffer focus filter so Tab / arrows / Esc reach the guest instead of being eaten by egui focus navigation.
• Forward Ctrl+C/X/V (egui-winit otherwise swallows them as clipboard commands), map F5, and let Ctrl+Alt+F11 send a bare F11 to IRIX.

Sandbox CHD consolidation (the fold needs folder, not file, access):

• handle.rs surfaces the fold error instead of swallowing it.
• Start + disk-assignment preflight (dir_writable probe) and a ChdGrantModal that prompts for a recursive folder grant, with a dedicated-folder tip.
• Auto-consolidate on a clean guest power-off (cpu_stopped edge), since macOS Cmd+Q bypasses the close-time fold (winit 0.29 has no applicationShouldTerminate).

Local sandboxed build (test the App Sandbox without the App Store):

• installer/iris-gui-sandbox-local.entitlements + build-macos.sh appstore (builds --features appstore, signs with app-sandbox).

GUI:

• Fix tofu glyphs: status dots are now sized bullets (U+2022); replaced U+25CF/2713/2717/2715/1F5C2/23FB and U+2192 with rendering equivalents.
• Build-features panel reports "jit: off (sandbox)" at runtime.
• Rename-machine is now a modal (the in-menu text box reset every frame).
• Config editor fills the pane when idle; header shows "Configuration — ".
• Help: Licenses... shows BSD-3-Clause (IRIS) plus GPL-3.0 (libchdman-rs/CHD) with source links, and Privacy policy... — both embedded via include_str!.
• Reworded "the serial console is NOT the network", removed "for App Review", renamed "Network test" to "Serial console".

LICENSE-GPL3.txt brought onto this branch (CHD builds are conveyed under GPL-3.0). Findings written up under rules/gui and rules/macos.