Prepare Maple Research 3.4.3 release

[AnthonyRonning]

Prepare Maple Research 3.4.3 on current master cd4218f5, advancing the pending 3.4.2 train because the US iOS App Store already publishes 3.4.2. Latest GitHub stable remains v3.4.1. This is a six-file version bump produced by nix develop --no-update-lock-file .#ci -c just update-version 3.4.3: Research manifests/Cargo.lock, Apple project/plist, and Android versionCode 2000028025 → 2000028026. No Agent, Auth, SDK, proxy, billing implementation, tag, or publication changes.

Release highlights since v3.4.1: quota upgrade prompts and draft recovery (#1064), SDK attestation clock handling (#937), chat/composer/sidebar polish, iOS purchase/recovery and account-deletion presentation, and signing/build tooling. These describe existing master changes, not new implementation in this PR. #1073 remains under separate review; no candidate PRs were merged, and #1024 inclusion remains undecided.

Validation:

• Release validator v3.4.3, Apple version parity, Android monotonicity and git diff --check: passed.
• Complete frontend CI: formatting, lint (13 warnings, zero errors), typecheck, 1,241 tests passed.
• nix flake check --no-update-lock-file: passed on aarch64-darwin; incompatible systems omitted by Nix.
• Helper's initial Cargo check failed on the fresh worktree's missing macOS ONNX Runtime. Standard prepare_macos_onnxruntime provisioned it; subsequent pinned cargo check --locked passed. Lock delta is only the app version.
• Locked Research metadata: registry maple-sdk 4.0.1, local maple-proxy 0.4.1. Frontend manifest/frozen Bun lock also select SDK 4.0.1; no dependency upgrade.
• Web PR artifact build: passed; dist tree SHA256 5245921c1432c3d4c45cfcb16eaeef353c6a9b545352f1113490993061584ed9. Fixed Dev API https://enclave.secretgpt.ai, Dev PCR policy, client ba5a14b5-d915-47b1-b7b1-afda52bc5fc6, Dev flags/billing endpoints. No login/runtime smoke claimed.
• Normal pre-commit gates passed, including locked metadata, Rust formatting and cargo test --locked --all-targets (419 library + 3 CLI passed, 2 ignored).
• Candidate commit: c211332cfacddaa7b0c186988646e32952867884. Fresh CI passed frontend/Rust tests, web, preview, release gates and supply-chain checks. Actual macOS/Linux/Windows desktop, Android fake-signed release, and iOS simulator builds passed. Windows desktop and downstream Windows artifact reproducibility verification passed; every exact-head workflow completed successfully.

Release gates and concerns:

• All selected exact-candidate platform builds and Windows artifact verification passed. Unrelated backend/SDK/GPUI jobs were skipped by change detection; these are not build evidence. PR artifacts use fixed hosted Dev and do not prove production/runtime integration.
• After review/merge, run the bundled release preflight on clean current master and require every exact-master workflow. This feature-branch invocation correctly fails closed with release from master, not codex/research-3.4.3. Merge will trigger normal production-shaped builds and TestFlight uploads. The PR remains draft and unmerged; complete the separate merge approval before that action.
• Latest approved Dev PCR0 8d65dc6a91b7db5e92b1ac273b9248f8a3f440edb29b56d455574f62857f572d9ec9bc9773d031e8e1be2fc33d1fe847 and Prod PCR0 16d3960ca1a7d1fb0700faf88ecdc5fcdeea3f9b7e1a0b1a1fa26b1fff0885a9548a3f40c5b18297067aacb20c26fdd9 are absent from Research app fallbacks and shipped TypeScript/Rust SDK 4.0.1. Auth app fallbacks also lack them. Canonical signed-history endpoints are reachable, but fallback compatibility without fetching remains a release concern. The release skill/SDK rollout policy places refresh in a separate trust-rotation/consumer review before the isolated bump; no trust-policy edits here. Auth has an independent pin/publisher.
• Apple billing deletion failure-path discrepancy requires its separate review; no billing implementation edits here. Reconfirm Apple upload train/store acceptance at release time.
• Proxy runtime/version decisions and actual app smoke remain release-preflight responsibilities; do not infer them from unit tests or packaging.

No master push, tag, release, store upload, deployment, or other candidate PR merge performed.

[github-actions]

Maple development preview: https://70a7022b.maple-ca8.pages.dev

Commit: c211332cfacddaa7b0c186988646e32952867884

Uses development API, billing, flags and PCR configuration. Cloudflare Access applies.