[Jelly-RayTian]

Every checkAppEntitlement call creates a SecTask and never releases it, including the missing-entitlement early return. LibraryStatus.update polls EntitlementStatus.check() every two seconds, which makes three such queries. The leak is small per query but accumulates across status polling and other checks.

Balance the task's Create ownership with a defer, and express the manually declared Copy API's retained result as Unmanaged<CFTypeRef> consumed by takeRetainedValue(). Boolean interpretation, absent/error results, UI status and signing permissions remain unchanged. Apple documents caller ownership for both SecTaskCreateFromSelf and SecTaskCopyValueForEntitlement.

Validation:

• python3 tests/host/check-entitlement-lifetimes.py compiles the actual checker and calls the real macOS Security.framework 2,000 times with an absent entitlement, draining autorelease pools. The unchanged base reports 2,000 SecTask leaks / 192,000 bytes; this patch reports 0 leaks / 0 bytes via Apple's leaks --atExit. The Boolean result remains false. No mocked task/allocator, certificate or provisioning profile is used. The regression targets the demonstrated missing-value task leak; present-value ownership follows the Copy API's documented contract.
• Extracted production checker type-checks for arm64 iOS 18 with the installed iPhoneOS SDK 26.5. This is source type-checking, not a whole-app build.
• git diff --check passes.

This was found while investigating reported launch/signing-status issues. It does not grant Memory+, change JIT detection, fix Astroneer's configuration timeout (#457), or establish the cause of any game/device termination. No real iPad run is claimed.

Based directly on the #461 runtime branch (54fc65ae), independently of #471 and #472. AI-assisted implementation and native host verification.