Split the project into Lanework and Lanework Pro targets

Two app targets from one source tree — no build flags, no #if in
shared code: an edition difference is a file one target compiles and
the other does not. Base keeps everything it had (dev.rzen.indie.Kanban,
minimal entitlements, AppIcon); KanbanPro compiles the same sources
plus the reserved KanbanPro/ root (Git/, Remote/, Auth/ land with
pro-m1 — libgit2 deliberately not added yet), adds network-client and
its keychain group, and hand-writes its Info.plist with the UTI block
verbatim — base exports the type, Pro imports it, one format either
app opens. The unit-test sources compile twice, once per host, with
Pro's module aliased so 56 test files keep @testable import Kanban
unchanged; scheme Kanban stays the muscle-memory command and
LaneworkPro joins it. InertGitTests pins the base posture with bytes
and mtimes — a full editing session over boards carrying realistic
.git trees at root and nested in a card leaves all twelve entries
untouched, and moves and copies carry them verbatim.
scripts/verify-editions.sh proves the rest: 26 checks over signatures,
symbols, entitlements, identity, and the shared UTI, discounting
Xcode's test-host exceptions by name rather than silently.

Claude-Session: https://claude.ai/code/session_01SR4XGjmBE16ZUYWpfFHXwY

KanbanPro/KanbanPro.entitlements

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<!-- Base's three, verbatim (Kanban/Kanban.entitlements) — the board experience is identical
+	     across editions, so its sandbox posture is too. -->
+	<key>com.apple.security.app-sandbox</key>
+	<true/>
+	<key>com.apple.security.files.user-selected.read-write</key>
+	<true/>
+	<key>com.apple.security.files.bookmarks.app-scope</key>
+	<true/>
+	<!-- Pro only (12-editions.md ▸ Targets): remotes. Base ships without this key at all, which
+	     is what makes "base cannot talk to a network" a checkable property of the signed binary
+	     rather than a promise about the source (scripts/verify-editions.sh). -->
+	<key>com.apple.security.network.client</key>
+	<true/>
+	<!-- Pro only: remote auth credentials (07-sync-collab.md ▸ Auth — Keychain, SSH, TOFU).
+	     A sandboxed app reaches its own keychain items without this key; the group is declared
+	     so the credential store has one stable, named home from pro-m2 onward instead of an
+	     implicit per-signature one that moves when the signing identity does. -->
+	<key>keychain-access-groups</key>
+	<array>
+		<string>$(AppIdentifierPrefix)dev.rzen.indie.KanbanPro</string>
+	</array>
+</dict>
+</plist>