Todo

Condensed from TODO.md at build time: 9 open item(s), 55 completed.

• decide whether `scripts/install.sh`, the release installer, should register the handler as `make install` now does. — The owner's instruction named `make install`; the release path takes a tarball and prints the integration step instead. Making the two consistent would also mean revisiting `tests/11-release-install.sh`, whose demo tarball carries no `pkpass-integrate` to register with.
• encode the other barcode formats a pass may carry: PDF417, Aztec, and Code 128. — `pkpass-render` draws QR today, which is what almost every pass uses; a pass whose first barcode is another format shows the payload and says the symbol could not be encoded.
• resolve a `.pkpasses` bundle: list the passes inside it and open one at a time. — The type is registered and opens, but `handle` treats a bundle as one file today.
• read the `<lang>.lproj/pass.strings` catalogs and apply the key indirection, so a localized pass shows its translations.
• draw the pass in the GTK4 viewer with the pass's own colours. — The first attempt mixed a per-pass stylesheet into the desktop theme and produced unreadable text for a light pass on a dark theme; the colors are carried by `pkpass-render` instead.
• add a Nautilus thumbnailer for `application/vnd.apple.pkpass` that runs `pkpass-render`.
• verify the CMS certificate chain against Apple's root when it is installed, and report the difference between a content check and a trusted chain in the report.
• add an `audit` command that reports a handler record which disagrees with the files on disk, as the AppImage project's `audit` does.
• write the episode plan for phases 3 and 4 in `prompts/episodes/02-episode-plan.md`.