fix(cua-driver): accept host identity in embedded health check

[injaneity]

Summary

• make the macOS health_report bundle identity check aware of embedded mode
• report the host TCC identity as valid when CUA_DRIVER_EMBEDDED=1
• retain the existing failure and CuaDriver.app remediation for non-embedded raw binaries
• add regression coverage for both embedded and standalone behavior

Why

Embedded mode intentionally keeps cua-driver in its host application's TCC responsibility chain. The current bundle_identity health check still requires com.trycua.driver, so a correctly embedded driver is reported as degraded and receives remediation that would break host attribution.

This is a focused diagnostic follow-up to #2102. It does not change the unsupported status of ordinary raw-binary standalone launches outside CuaDriver.app.

Testing

• cargo check --manifest-path libs/cua-driver/rust/Cargo.toml -p platform-macos --tests
• git diff --check

The focused test binary compiles but cannot link in the local Command Line Tools-only environment because Swift compatibility libraries are unavailable.