Pocket Poster 3.3.0: worse_query port for iOS 26-27.2

- Replace bad_query with forcequitOS/worse_query (App Group based)
- Read the App Group from the code signature entitlements
- Add pathleak container enumeration and iOS 27 system container lookup
- Route descriptor/CarPlay writes through worse_query
- Add sign_personal.sh and POCKET_POSTER_SELFTEST diagnostics
- Keep bad_query as an iOS 26 fallback

Pocket Poster/Exploit/SelfTest.swift

@@ -0,0 +1,77 @@
+//
+//  SelfTest.swift
+//  Pocket Poster
+//
+//  Launch-time diagnostics, enabled with POCKET_POSTER_SELFTEST=1.
+//  Used to verify worse_query and container discovery on-device.
+//
+
+import Foundation
+import UIKit
+
+enum SelfTest {
+    static var isEnabled: Bool {
+        ProcessInfo.processInfo.environment["POCKET_POSTER_SELFTEST"] == "1"
+    }
+
+    static func run() {
+        print("=== Pocket Poster self-test ===")
+        print("OS: \(ProcessInfo.processInfo.operatingSystemVersionString)")
+        print("Bundle: \(Bundle.main.bundleIdentifier ?? "?")")
+        print("App Group: \(SandboxEscape.appGroupIdentifier ?? "nil")")
+        print("Backend: \(String(describing: SandboxEscape.backend))")
+
+        guard SandboxEscape.isAvailable else {
+            print("self-test: sandbox escape unavailable")
+            print("=== self-test done ===")
+            return
+        }
+
+        // 1. Can worse_query grant access to each search root?
+        for root in SandboxEscape.defaultSearchRoots {
+            do {
+                let handle = try SandboxEscape.consume(path: root, create: true)
+                print("access OK: \(root) (handle \(handle.handle))")
+                handle.release()
+            } catch {
+                print("access FAIL: \(root): \(error.localizedDescription)")
+            }
+        }
+
+        // 2. Can we find PosterBoard's data container?
+        let start = Date()
+        do {
+            let hash = try SandboxEscape.findPosterBoardHash()
+            print("PosterBoard hash: \(hash) (scan \(String(format: "%.1f", Date().timeIntervalSince(start)))s)")
+            let container = SandboxEscape.applicationContainerPath(appHash: hash)
+            print("PosterBoard container: \(container)")
+
+            // 3. Can we open the CollectionsPoster descriptors directory?
+            let descriptors = SandboxEscape.descriptorsPath(
+                appHash: hash,
+                ext: "com.apple.WallpaperKit.CollectionsPoster"
+            )
+            do {
+                let handle = try SandboxEscape.consume(path: descriptors, create: true)
+                print("descriptors OK: \(descriptors) (handle \(handle.handle))")
+                handle.release()
+            } catch {
+                print("descriptors FAIL: \(descriptors): \(error.localizedDescription)")
+            }
+        } catch {
+            print("PosterBoard detect FAIL: \(error.localizedDescription)")
+        }
+
+        // 4. CarPlay container (phones only).
+        if UIDevice.current.userInterfaceIdiom == .phone {
+            do {
+                let hash = try SandboxEscape.findCarPlayHash()
+                print("CarPlayWallpaper hash: \(hash)")
+            } catch {
+                print("CarPlayWallpaper detect FAIL: \(error.localizedDescription)")
+            }
+        }
+
+        print("=== self-test done ===")
+    }
+}