feat(macos): add macOS menu-bar app and harden cross-device iCloud sync

Introduce a standalone macOS menu-bar app (OSGKeyboardMac) that reuses the
platform-agnostic OSGKeyboardShared core: record -> cloud/local ASR -> polish
-> insert. Local mode uses Qwen3-ASR via mlx-swift-asr (macOS 15+, Apple
Silicon); iOS targets stay zero-SPM.

Harden iCloud sync for multi-device correctness:
- Per-field settings merge (appSettings.v2) so concurrent edits no longer
  clobber each other's unrelated fields.
- Per-device usage statistics (G-Counter) that sum instead of max().
- Tombstoned dictionary/history merge so deletes propagate and entries can't
  resurrect.
- API keys replicate via iCloud Keychain, never iCloud KVS JSON; pulling a
  legacy blob without key fields no longer wipes local Keychain entries.
- Add a low-risk "Sync Now" action in Settings.

Fix Flow keyboard mic state: stay orange until the host publishes a real ready
contract, share a single MicVoiceAvailability gate, and self-heal stale
cross-process heartbeat jitter instead of getting stuck.

Extract shared storage (SpeechHistoryStore/UsageStatisticsStore,
ConfigurationStore) into OSGKeyboardShared and add tests for the new
sync/merge logic.

OSGKeyboardTests/FlowSessionBridgeTests.swift

@@ -141,5 +141,46 @@ final class FlowSessionBridgeTests: XCTestCase {
 
     func testDarwinNotificationPostsWithoutCrashing() {
         FlowSessionDarwin.postSessionChanged()
+        FlowSessionDarwin.postHostReadyChanged()
+    }
+
+    func testHostReadyRequiresExplicitContract() {
+        let defaults = makeDefaults()
+        FlowSessionBridge.markSessionActive(duration: 60, defaults: defaults)
+        XCTAssertTrue(FlowSessionBridge.isHostReachable(defaults: defaults))
+        XCTAssertFalse(FlowSessionBridge.isHostReady(defaults: defaults))
+
+        FlowSessionBridge.setHostReady(true, defaults: defaults)
+        XCTAssertTrue(FlowSessionBridge.isHostReady(defaults: defaults))
+    }
+
+    func testHostReadyFalseWhenHeartbeatStale() {
+        let defaults = makeDefaults()
+        FlowSessionBridge.markSessionActive(duration: 3_600, defaults: defaults)
+        FlowSessionBridge.setHostReady(true, defaults: defaults)
+        XCTAssertTrue(FlowSessionBridge.isHostReady(defaults: defaults))
+
+        let staleHeartbeat = Date().timeIntervalSince1970 - 10
+        defaults.set(staleHeartbeat, forKey: FlowSessionKeys.flowHeartbeat)
+        XCTAssertFalse(FlowSessionBridge.isHostReady(defaults: defaults))
+    }
+
+    func testHeartbeatRefreshKeepsHostReadyPublished() {
+        let defaults = makeDefaults()
+        FlowSessionBridge.markSessionActive(duration: 3_600, defaults: defaults)
+        FlowSessionBridge.setHostReady(true, defaults: defaults)
+
+        FlowSessionBridge.writeHeartbeat(defaults: defaults)
+
+        XCTAssertTrue(FlowSessionBridge.isHostReady(defaults: defaults))
+    }
+
+    func testClearFlowStateClearsHostReady() {
+        let defaults = makeDefaults()
+        FlowSessionBridge.markSessionActive(defaults: defaults)
+        FlowSessionBridge.setHostReady(true, defaults: defaults)
+        FlowSessionBridge.clearFlowState(defaults: defaults)
+        XCTAssertFalse(defaults.bool(forKey: FlowSessionKeys.flowHostReady))
+        XCTAssertFalse(FlowSessionBridge.isHostReady(defaults: defaults))
     }
 }