docs(macOS): document TCC csreq invalidation after re-signing WeChat (#48)

macOS TCC binds permissions to (bundle id, csreq) where csreq encodes
the app's code signature. `codesign --force --deep --sign -` on
WeChat changes the csreq, silently invalidating every existing TCC
grant for com.tencent.xinWeChat — yet System Settings still paints
each toggle as ON because the UI only checks bundle id, hiding the
drift. WeChat then reprompts for screen recording / camera /
microphone / file access despite "looking allowed".

Three doc-only updates, no code changes:

- README.md quick start: add the `tccutil reset` loop right after the
  codesign step, plus a one-line callout pointing at the deep-dive
  section.
- SKILL.md macOS init flow: same loop in the agent-readable order, so
  agents executing the steps don't skip it.
- docs/macos-permission-guide.md: new section 五 with first-principles
  root cause, the reset loop, the macOS 26 "录屏与系统录音 / 仅系统
  录音" UI split footgun, and ad-hoc signature verification.

Builds on the BobbyCat PR #29 — keeps the symptom description and the
macOS 26 UI split note, expands scope from ScreenCapture-only to all
TCC services that re-signing actually breaks (Camera / Microphone /
AppleEvents / AddressBook / Documents / Downloads / Desktop), drops
the misleading TCC.db sqlite query (path varies by macOS version, can
need FDA, and is no more useful than just trying WeChat's screenshot
again), and explicitly leaves the reset as a manual step rather than
auto-running it from `wx init` because it would wipe currently-working
grants.

Co-authored-by: BobbyCat <114374951+BobbyCats@users.noreply.github.com>

SKILL.md

@@ -66,14 +66,33 @@ codesign --remove-signature "/Applications/WeChat.app/Contents/Frameworks/vlc_pl
 codesign --force --deep --sign - /Applications/WeChat.app
 ```
 
-**第二步：重启 WeChat**
+**第二步：清理 WeChat 在 macOS TCC 隐私数据库里的旧授权记录**（重签名后必做）
+
+macOS TCC 按 `bundle id + csreq` 联合校验权限；csreq 编码自代码签名。重签名后旧 csreq 和新签名不再匹配，旧授权记录会 silent 失效（System Settings 仍把开关画成"已允许"，运行时实际拒绝）。把 WeChat 在 TCC 里的旧记录抹掉，让 macOS 在下次微信请求权限时按新签名重新生成 csreq：
+
+```bash
+tccutil reset ScreenCapture com.tencent.xinWeChat   # 截图 / 屏幕共享
+tccutil reset Camera com.tencent.xinWeChat          # 视频通话 / 扫码
+tccutil reset Microphone com.tencent.xinWeChat      # 语音消息 / 通话
+tccutil reset AppleEvents com.tencent.xinWeChat     # 自动化 / 输入法
+tccutil reset AddressBook com.tencent.xinWeChat     # 通讯录
+tccutil reset SystemPolicyDocumentsFolder com.tencent.xinWeChat
+tccutil reset SystemPolicyDownloadsFolder com.tencent.xinWeChat
+tccutil reset SystemPolicyDesktopFolder com.tencent.xinWeChat
+```
+
+`tccutil` 对没有授权过的 service 会报 "No such bundle identifier"，是 no-op，不影响其他 service 的 reset。
+
+**第三步：重启 WeChat**
 
 ```bash
 killall WeChat && open /Applications/WeChat.app
 # 等待微信完全登录后再继续
 ```
 
-**第三步：初始化**
+之后微信触发权限请求时按 GUI 提示重新允许即可。在 macOS 26 上，把 WeChat 加进 **隐私与安全 → 录屏与系统录音** 的上半区，**不要**只勾下半区的"仅系统录音"——后者不能授予截图权限。
+
+**第四步：初始化**
 
 ```bash
 sudo wx init