Sandbox the Finder extension so macOS actually loads it

The context menu never appeared because the extension wasn't registered at all:
pluginkit didn't list it, and it says nothing about why. macOS only loads Finder
Sync extensions that are sandboxed, and the target had App Sandbox off, so the
appex was silently ignored.

It now ships with its own entitlements — sandbox plus read-only access to the
items picked in Finder, which is all it needs to read the selection and open a
kotej:// URL. The containing app stays unsandboxed, since comparing arbitrary
folders needs unrestricted file access.

Verified: pluginkit lists it as enabled and the extension is loaded by Finder.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UfhDYRLTpGJSKGP1m3LVJN

FinderExtension/KotejFinder.entitlements

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <!-- macOS only loads Finder Sync extensions that are sandboxed; without this
+         pluginkit ignores the appex without reporting anything. -->
+    <key>com.apple.security.app-sandbox</key>
+    <true/>
+    <!-- Needed to read the URLs of the items selected in Finder. -->
+    <key>com.apple.security.files.user-selected.read-only</key>
+    <true/>
+</dict>
+</plist>

project.yml

@@ -13,7 +13,7 @@ settings:
     DEVELOPMENT_TEAM: "2825Q76T7H"
     CODE_SIGN_STYLE: Automatic
 packages:
-  KotejEngine:
+  Kotej:
     path: .
 targets:
   Kotej:
@@ -27,7 +27,7 @@ targets:
       - path: Resources
         buildPhase: resources
     dependencies:
-      - package: KotejEngine
+      - package: Kotej
         product: KotejEngine
       - target: KotejFinder
     settings:
@@ -61,8 +61,9 @@ targets:
     settings:
       base:
         PRODUCT_BUNDLE_IDENTIFIER: com.alexandrev.kotej.finder
-        ENABLE_APP_SANDBOX: NO
+        ENABLE_APP_SANDBOX: YES
         ENABLE_HARDENED_RUNTIME: YES
+        CODE_SIGN_ENTITLEMENTS: FinderExtension/KotejFinder.entitlements
     info:
       path: FinderExtension/Info.plist
       properties: