feat(discovery): remember receivers independently of IP

[Betafer]

Why

We use TargetBridge between a Mini and several iMacs, with both wired and wireless paths. Remembering service|ip can lose the selected monitor after a network change; selecting the first discovered Receiver can also choose the wrong Mac.

This is the small discovery/selection foundation for simpler pairing, independently rebased on maint-3.5 (fb45b5f). No SSH setup, automatic-login installer, control helper, or pairing wizard is included.

Change

• Receiver persists a UUID in its application preferences and advertises it in an optional receiverID Bonjour TXT field.
• Sender uses the normalized UUID for picker/persisted identity. Old Receivers without a valid UUID retain the Bonjour-name fallback; old saved service/IP selections migrate on discovery.
• Keep two different UUID Receivers distinct even if their display names match.
• Automatic selection honors the saved monitor, waits briefly for discovery to settle, and refuses an ambiguous choice. If the remembered monitor is absent, it does not silently substitute another one.
• An unresolved identity reference is not passed to networking as a raw hostname. Explicit IP/hostname addressing remains available.
• Malformed stored/advertised IDs are handled; a failed new-ID persistence does not advertise that transient ID.

The UUID is a discovery/preference identifier, not authentication or encryption. This does not change transport or authorize remote control.

Validation

• ruby TargetBridge-Sender/scripts/test_receiver_identity.rb passes 30 XCTest cases against extracted production model/selection code plus the actual C persistence function in a unique disposable preferences domain. No application or capture/input permission prompt is launched.
• Includes changed IP/name, legacy selection migration, normalized/malformed UUIDs, same-name distinct IDs, missing preferred monitor, ambiguous selection, explicit-address/reference distinction, UUID creation/reload, invalid preference type, and buffer/argument guards.
• Full rebased Sender and test target: xcodebuild build-for-testing passed on Apple Silicon.
• Full rebased Receiver build passed locally; parser 67, input queue 562, idle watchdog 12, and profile 13 checks passed.
• The stable identity path has also been used in our installed Mini/iMac integration before this isolated rebase. The additional malformed-ID / wrong-monitor guards are covered by the tests above, not claimed as a new interactive multi-Mac migration test.

Review boundaries

The local Receiver build links local macOS 26 libraries; it is a compile check, not an Intel/macOS 11 distribution artifact. CI should cover both architectures. A first migration from a name-derived virtual-display identity to UUID may cause macOS to treat it as a new display; please review that migration policy before release.