feat(macos): foundation of the macOS app ported from Swift to Rust

Phase 9, MA1: crates/ghostty-macos (AppKit via objc2; empty stub on
non-Apple targets) ports the foundation of Ghostty 1.3.1's Swift macOS
app (ghostty/macos): main, AppDelegate (+Ghostty) with lifecycle, dock
menu, open-file, notifications, shortcut sync and quit/reopen paths;
MainMenu.xib as generated menu tables built into NSMenus; the
Ghostty.App/Config/Surface wrappers driving libghostty in-process via
ghostty-lib; the generic helpers; scripts/macos-bundle.sh to assemble
Ghostty.app (dry-run on Linux). Feature areas are stubbed for MA2-MA5.
Design and type mapping: docs/rewrite/notes/macos-app-design.md
(App Intents is a Swift-only framework and cannot be ported).

Compile-checked only (no macOS here): just check-macos passes for
aarch64/x86_64-apple-darwin with -D warnings; 125 platform-independent
tests run on Linux.

Test Plan:
- just check-macos
- cargo test -p ghostty-macos

crates/ghostty-macos/src/features/secure_input/mod.rs

@@ -0,0 +1,41 @@
+//! `Sources/Features/Secure Input` (owner: MA4).
+//! MA1 provides the `SecureInput.shared` surface `AppDelegate` uses
+//! (`global`, `enabled`). TODO(MA4): Carbon `EnableSecureEventInput` handling,
+//! scoped objects, activation observers and the overlay.
+
+use std::{cell::Cell, rc::Rc};
+
+/// `SecureInput`.
+#[derive(Default)]
+pub struct SecureInput {
+    global: Cell<bool>,
+    enabled: Cell<bool>,
+}
+
+thread_local! {
+    static SHARED: Rc<SecureInput> = Rc::default();
+}
+
+impl SecureInput {
+    /// `shared`.
+    #[must_use]
+    pub fn shared() -> Rc<Self> {
+        SHARED.with(Rc::clone)
+    }
+
+    #[must_use]
+    pub fn global(&self) -> bool {
+        self.global.get()
+    }
+
+    /// `global` setter (`didSet { apply() }`). TODO(MA4): apply.
+    pub fn set_global(&self, v: bool) {
+        self.global.set(v);
+    }
+
+    /// `enabled`.
+    #[must_use]
+    pub fn enabled(&self) -> bool {
+        self.enabled.get()
+    }
+}