[bbjansen]

Summary

Three independent, previously-parked changes, re-based onto current main:

1. fix(ai): AIKeychain in-process key cache - a provider key is read from the Keychain at most once per launch, eliminating the repeated macOS "allow access" prompt that fired on every AI-preferences open and request.
2. fix(ui): Command Palette and Quick Connect z-order - both panels now attach as child windows at .normal level and anchor to the terminal window, so they no longer float above every other application when Simpleton is in the background.
3. chore(e2e): screenshot / demo harness - opt-in and OFF by default. SIMPLETON_SHOT_DEMO seeds non-personal demo data (process list, SSH tunnels, file browser, a sample AI exchange); launch flags --shot-profile, --shot-active-panel, --shot-fullscreen; accessibility identifiers on panel buttons and skill rows; and axdriver bounds / pressrole commands plus a perf (skip AXWebArea) and menu-bar-first lookup improvement.

Commits

• 998af9c fix(ai): cache API keys in-process to stop repeated Keychain prompts
• b0559d5 fix(ui): keep command palette and quick connect in the window z-order
• e65feba chore(e2e): screenshot/demo harness - env-gated demo data, launch flags, axdriver

Verification

• swift build - Build complete (app target).
• swift run CoreChecks - all 1686 checks pass.
• swift format lint --strict --recursive Sources Tests - clean.

Notes

• The screenshot harness is entirely opt-in (env var / launch flags); there is no behavior change in normal use.
• terminalWindow detection uses the current activeTabContainer accessor, since the window's content view controller became a swappable host after these changes were first drafted.

Breaking changes

None. All three changes are additive or internal.