Improve provisioning profile regeneration and cleanup

[Redth]

Provisioning profile regeneration could silently lose capabilities that were no longer assigned to the App ID, while local downloads and installs accumulated stale copies across Xcode profile directories. This change makes regeneration and local profile management safer and easier to inspect.

• Preflight regeneration with a temporary generated profile and compare its actual App Group entitlements before deleting the existing profile.
• Treat App Groups as portal-managed because the current App Store Connect API cannot configure their identifier assignments.
• Replace older matching downloads atomically, prompt for ambiguous conflicts, and protect against files changing after review.
• Add Auto, Xcode 16+, Xcode 15 and earlier, and Both directory modes for installation and Finder reveal.
• Add native toolbar actions for opening profile folders and reviewing installed profiles.
• Add a cleanup dialog that explains profile health, preselects only expired, unreadable, superseded, or certificate-orphaned profiles, and confirms before deleting selected files.
• Cover entitlement validation, directory selection, download conflicts, duplicate analysis, and cleanup recommendations with focused tests.