Print: entitle the sandbox, and stop the ⌘P chord from ever falling through

Root cause of the owner's repro (board window frontmost, File ▸ Print…
enabled, chosen from the menu, alert appears anyway): Kanban.entitlements
carried no com.apple.security.print key. The app is sandboxed, and a
sandboxed NSPrintOperation is denied by the sandbox with exactly this
wording — "This application does not support printing. Please contact
the application's developer." — regardless of which code path invokes
it. Fix: add the entitlement.

Alongside it, hardening for a separate, narrower failure mode that
happens to produce the identical alert text by a different mechanism:
PrintCommand used to disable itself over a window that published
neither a board nor a printable card (welcome, the template chooser,
Settings, the restore-bootstrap window, a card window whose board
hasn't joined). A disabled SwiftUI Button still owns its
.keyboardShortcut, so the unclaimed ⌘P chord fell through to AppKit's
own nil-target printDocument: action, whose stock failure is the same
system alert. The row now claims ⌘P unconditionally in every window;
scope resolves at the moment of the action instead (board, then card,
then a polite "Nothing to Print" / "Open a board or a card to print
it." refusal in the app's own voice). The boolean isEnabled(hasBoard:
hasPrintableCard:) becomes a three-way PrintCommand.resolveScope(...)
-> Scope pure function.

Also implements AppDelegate's application(_:printFiles:withSettings:
showPrintPanels:) — Finder's own File ▸ Print… / drag-to-printer /
print-and-open path was previously unhandled, its own separate route
to the same stock alert. PrintCoordinator.printFiles loads each path
headless through BoardLoader (no store, no window) and either prints
it or gives the same one-sentence refusal; the operation-building code
shared with the in-app path is factored out of run(_:) into
makeOperation(for:showsPrintPanel:) and runOperation(_:session:).

Docs: 11-command-nexus.md's Print row, PrintCommand's and
PrintCoordinator's doc comments, KanbanApp.swift's CommandGroup
comment, and project.yml's entitlements comment all narrate the
entitlement as the actual fix and the scope work as hardening beside
it.

Tests: PrintCommandValidationTests now exercises resolveScope's three
arms in place of the old boolean. A new PrintFinderResolutionTests
suite covers PrintCoordinator.resolveFinderPrint(atPath:) — the one
piece of the Finder half a test can drive without handing AppKit a
real print job — against a real board, an empty non-board folder, a
plain file, and an unsupported schema.

Claude-Session: https://claude.ai/code/session_014PtZdPwqZuqEDLc6wZMtEy

project.yml

@@ -92,13 +92,15 @@ targets:
         PRODUCT_MODULE_NAME: Kanban
         MARKETING_VERSION: "2.0"
         INFOPLIST_FILE: Kanban/Info.plist
-        # `Kanban/Kanban.entitlements` — sandbox, user-selected files, app-scope bookmarks, and
-        # `com.apple.security.network.client`, **declared now and exercised by nothing**: the key
-        # stays because the sync capability to come needs it regardless (12-editions.md ▸ PIVOT
-        # 2026-08-08), and a key added later is a new provisioning profile and a new review
-        # surface. No App Group and no keychain access group — groups exist to share *between*
-        # apps, and there is one app, so app-side state homes in the ordinary sandbox container
-        # (`AppStateHome`).
+        # `Kanban/Kanban.entitlements` — sandbox, user-selected files, app-scope bookmarks,
+        # `com.apple.security.print` (added 2026-08-09 — a sandboxed `NSPrintOperation` is denied
+        # without it, with the misleading system alert "This application does not support
+        # printing"), and `com.apple.security.network.client`, **declared now and exercised by
+        # nothing**: the key stays because the sync capability to come needs it regardless
+        # (12-editions.md ▸ PIVOT 2026-08-08), and a key added later is a new provisioning profile
+        # and a new review surface. No App Group and no keychain access group — groups exist to
+        # share *between* apps, and there is one app, so app-side state homes in the ordinary
+        # sandbox container (`AppStateHome`).
         CODE_SIGN_ENTITLEMENTS: Kanban/Kanban.entitlements
         GENERATE_INFOPLIST_FILE: false
         SWIFT_STRICT_CONCURRENCY: complete