Add HTTPS universal review links after Apple signing is available

[lastobelus]

Outcome

Agents can emit an ordinary HTTPS review link that supported macOS hosts render as clickable and route into Markover, while browsers receive a safe fallback page when Markover is unavailable.

Example canonical shape:

https://open.<markover-domain>/review/<review-id>

A future PR-development route may use an exact path such as /pr/<number>/review/<review-id> and delegate to the existing markover-<PR>: handler without giving each PR build its own associated-domain identity.

Why this is deferred

PR #76 / issue #52 proves that the local markover: and markover-<PR>: schemes work through macOS and Terminal open, but T3 Code and the current Codex host do not preserve or dispatch those custom-scheme Markdown links.

A genuine HTTPS universal link requires:

• a controlled public HTTPS domain and an apple-app-site-association file;
• the com.apple.developer.associated-domains entitlement;
• an Apple-authorized provisioning profile and stable application identity; and
• signed application or bridge handling for NSUserActivityTypeBrowsingWeb.

Markover currently ships hardened ad-hoc-signed builds. Joining the Apple Developer Program is not currently planned, so this issue has no milestone and is not on the active roadmap. It becomes actionable only if that decision changes and #13 activates the required signing identity.

Acceptance criteria

• The chosen HTTPS host serves /.well-known/apple-app-site-association over valid TLS without redirects.
• The AASA file and signed Markover entitlement agree on the exact stable application ID and only the intended review paths.
• Incoming URLs strictly validate host, route, PR number when present, and managed-review ID; credentials, arbitrary actions, query data, fragments, and redirects are rejected.
• Canonical HTTPS links reuse Open a specific review through a Markover deep link #52's authenticated activation and renderer acknowledgement.
• Any PR-scoped HTTPS route delegates only to the exact existing markover-<PR>: identity and never searches or falls back to another instance.
• The browser fallback reveals no review content or local credentials and provides installation/recovery guidance.
• Warm, cold, missing-app, missing-review, malformed-link, T3 Code, Codex, Safari, and Terminal behavior is manually verified with the signed artifact.
• Agent guidance switches its primary handoff to HTTPS only after the signed end-to-end path is deployed.

Boundaries

This issue does not add a redirect-only HTTPS trampoline, expose reviews over the network, require per-PR Apple signing, or change #52's local custom-scheme and authenticated-loopback ownership.

[lastobelus]

The prerequisite custom-scheme implementation landed in PR #76 as 16c3e31. This issue remains intentionally deferred: current agent hosts use PR #74’s standalone Terminal open '<reviewUrl>' workaround, and HTTPS universal links wait for #13 plus a future Apple Developer Program decision.