feat: bump apple-pim to 2.4.0, add COS profile integration

[omarshahine]

Summary

• Bump apple-pim from v2.3.0 to v2.4.0 in marketplace
• Bump chief-of-staff to v2.0.1 (config/doc changes)
• Bump marketplace metadata to v2.0.1
• Add apple_pim_profile config field to COS settings.example.yaml
• Add Apple PIM profile detection to /chief-of-staff:setup (Phase 3)
• Add "Apple PIM Profile Integration" section to COS README
• Expand Apple PIM integration docs in SKILL.md

Context

Apple PIM v2.4.0 introduces PIMConfig shared Swift library with allowlist/blocklist filtering and multi-agent workspace profiles at ~/.config/apple-pim/profiles/{name}.json. Profiles are transparent at the MCP tool layer — the MCP server passes APPLE_PIM_PROFILE as an env var to Swift CLIs. No COS agent code changes needed.

Test plan

• Verify /mcp shows apple-pim MCP server loading
• Verify COS works with no profile configured (backwards compatible)
• Test /chief-of-staff:reminders still creates reminders
• Test /chief-of-staff:setup detects profiles when present at ~/.config/apple-pim/profiles/
• Verify PII check CI passes (all examples use generic placeholders)

🤖 Generated with Claude Code

[github-actions]

PII Check Failed

The following potential PII was detected in this PR:

• Email address in plugins/chief-of-staff/skills/chief-of-staff/SKILL.md

Please fix before merging. Use generic placeholders:

• Paths: ~/, ${HOME}, or relative paths
• Emails: user@example.com
• Phone: 555-123-4567
• Addresses: 123 Main St
• Secrets: ${VAR_NAME}

[claude]

Claude finished @omarshahine's task in 1m 58s —— View job

---

Code Review Complete

Tasks:

• Read changed files
• Review version bumps
• Identify PII violations
• Check documentation accuracy
• Review configuration changes
• Provide final feedback

---

Issues Found

🔴 Critical: Marketplace Version Mismatch

The marketplace.json plugin entry for chief-of-staff is still at version 2.0.0 but should be 2.0.1 to match the plugin's version.

Location: .claude-plugin/marketplace.json:16

{
  "name": "chief-of-staff",
  "version": "2.0.0",  // ❌ Should be 2.0.1
  ...
}

According to CLAUDE.md versioning rules:

Where to Update

Change Type	Update Plugin Version	Update Marketplace Version	Update Plugin Entry in marketplace.json
Plugin change	✓	✓	✓

Fix this →

🟡 PII Check False Positive

The CI flagged accounting@vendor.example.com in SKILL.md:93 as PII. This is a false positive — it's a legitimate example email in documentation using the reserved example.com domain (RFC 2606).

Root cause: The PII check pattern @example\.com doesn't match subdomains like @vendor.example.com. The workflow should be updated to use @[a-zA-Z0-9.-]*example\.com to match all example.com subdomains.

Options:

1. Change the email to accounting@example.com to pass the current check
2. Update the PII check workflow to properly handle subdomains (better long-term fix)

Since this blocks the PR merge, I recommend option 1 for now:

Fix this →

---

What Looks Good ✓

Version Bumps

• ✓ Apple PIM: 2.3.0 → 2.4.0 (marketplace.json:43)
• ✓ Chief-of-Staff plugin: 2.0.0 → 2.0.1 (plugin.json:3)
• ✓ Marketplace metadata: 2.0.0 → 2.0.1 (marketplace.json:8)
• ⚠️ Marketplace plugin entry: Needs update (see above)

Documentation Quality

• ✓ Apple PIM Profile section in README.md (lines 127-160): Clear, well-structured explanation of profile integration
• ✓ Setup command update (setup.md:140-167): Comprehensive profile detection logic with proper AskUserQuestion flow
• ✓ Config file update (settings.example.yaml:78-82): Helpful comments explaining profile usage and env var setup
• ✓ SKILL.md update (line 180): Concise but complete profile reference

Technical Accuracy

• ✓ Correctly describes profiles as "transparent at the MCP tool layer"
• ✓ Proper environment variable handling via APPLE_PIM_PROFILE
• ✓ Backwards compatibility maintained (null profile = base config)
• ✓ Clear setup instructions for both CLI and Cowork users

No Code Changes Required

The claim in the PR description is validated: "No COS agent code changes needed" — all changes are configuration and documentation. This is good separation of concerns.

---

Recommendations

Must Fix Before Merge

1. Update marketplace.json plugin entry version to 2.0.1
2. Fix the PII check issue (use accounting@example.com instead of subdomain)

Nice to Have (Future PRs)

• Consider updating the PII check workflow to handle *.example.com subdomains properly
• Add a test in the setup command that validates the APPLE_PIM_PROFILE env var is actually set in settings.local.json (currently the documentation tells users to set it, but doesn't verify)

---

Summary

This is a solid PR that properly integrates Apple PIM v2.4.0 profile support into Chief-of-Staff. The documentation is clear and comprehensive, versioning follows semantic conventions, and backwards compatibility is maintained.

Action Required: Fix the two issues above before merging.