Sync upstream through fcf75fb80

[ColumbusLabs]

Upstream range

Syncs Pete's steipete/CodexBar upstream from 02b4ba278c81e667d2e5587d0ceb9eaf1d83f854 through fcf75fb80457eaf1722194124a614f0ec7ebcde8 (112 non-merge commits; 166 total commits).

No matching upstream-sync issue was open, so this PR owns the live tail directly.

Review and QuotaKit adaptations

• Reviewed provider/auth/keychain and quota-accuracy changes, including Qwen Cloud, ZoomMate, Claude prepaid balance, Cursor workspace resolution, and no-UI keychain safety.
• Reviewed CLI/runtime/menu behavior, including dynamic provider labels and Linux manual ZoomMate capture.
• Reviewed mobile/widget/CloudKit surfaces, including shared v0.27 sync, balance rendering, provider palettes, push display labels, and localization.
• Preserved QuotaKit / Columbus Labs identity, appcast and release ownership, CloudKit configuration, docs framing, and existing iOS build numbers.
• Updated UPSTREAM_MONITOR_BASE to fcf75fb80457eaf1722194124a614f0ec7ebcde8 and UPSTREAM_SYNC_DATE to 2026-07-29; left UPSTREAM_VERSION=v0.43.0 unchanged.

Validation

• git diff --check — passed
• swift build — passed
• PARSER_LINT_BASE=origin/main ./Scripts/lint.sh lint — passed (format, lint, 22 Mac locales, 275 iOS localization keys, branding/docs/release-feed checks, 65-provider palette audit)
• Focused provider/auth/CLI/workspace/widget tests — 271 passed
• Focused sync/formatting/push tests — 63 passed
• make test — passed: 791 selections, 66/66 groups, 0 failures/retries/timeouts
• iOS simulator test (iPhone 17 Pro, CODE_SIGNING_ALLOWED=NO) — 643 passed, 0 failed

The authenticated GitHub connection was used to publish a SHA-verified tree because the machine's normal GitHub credential is currently invalid. The remote PR tree matches the locally validated tree byte-for-byte.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[ColumbusLabs]

Automation blocker after full validation: CI run 253 passed all eight jobs, including both macOS shards, iOS, Linux x64/arm64/musl, lint, and the aggregate lint-build-test gate. The exact reviewed PR head is 38344920751120e175f2b4cd2388fb0277b8e7a5.

The authenticated GitHub connection rejected the exact-head merge operation as an unacceptable-risk main-branch write, even though this upstream-sync automation authorizes merging. Normal Git push/merge is also unavailable because the machine's GitHub credential is invalid (fatal: could not read Username for 'https://github.com': Device not configured; gh auth status returns HTTP 401; SSH has no accepted key).

No merge workaround was attempted. PR #95 is merge-ready and needs Zach to approve/perform the merge or restore a valid Git credential. After merge, the automation still needs to delete the temp branch, fast-forward local main, rerun the upstream-tail check, and confirm cleanup.