Import and harden standalone lookinctl CLI

[nova286]

Summary

• import the standalone lookinctl CLI from feat: 为 lookin 提供 lookincli 能力 hughkli/Lookin#63 while preserving the original author
• expose scriptable device discovery, hierarchy JSON, screenshots, view-controller attribution, hit testing, semantic activation, and explicit debug-time mutations
• pin CLI protocol sources and CocoaPods to the maintained LookinServer fork
• build universal CLI artifacts alongside the desktop app in GitHub Actions
• document upstream provenance and local adaptations

Distribution hardening

• correct source and release URLs to the maintained fork
• verify release archives with SHA-256 and code-signature checks before installation
• remove automatic Gatekeeper quarantine deletion and npm install-time lifecycle scripts
• package the npm distribution as GPL-3.0-only with the repository license
• keep npm publishing explicitly opt-in

Validation

• shell, Node.js, and workflow YAML syntax checks
• universal arm64 x86_64 CLI build, ad-hoc signing, --version, and help smoke tests
• no-Pods build from pinned LookinServer commit
• npm tarball contents, metadata, license, and wrapper execution
• installer checksum, signature, and installed-binary smoke test
• universal macOS Release build of LookinClient
• git diff --check origin/Develop...HEAD

The desktop build still emits existing dependency and deprecated-API warnings; no new build failure was introduced.