fix: restore strict relationship-backed reads

[zelentsov-dev]

Summary

• request Apple-supported relationship expansions for App Store version metadata, localization, review-detail, review-attachment, review-submission, and legacy age-rating reads
• keep all existing app/version/parent ownership checks fail-closed; missing or mismatched linkage is still rejected
• make review_submissions_list always add the owning app to its effective include set
• pin the updated Apple API 4.4.1 operation contract and prepare v4.1.3

This safely adapts the live report in #6 without accepting resources whose parent linkage is absent. Thanks @muenzpraeger for the reproduction and analysis.

Verification

• Apple App Store Connect OpenAPI 4.4.1 strict contract: 502 tools, 0 structural errors, 0 implementation drift, 0 warnings
• optional-input pin: 2,905 total / 1,122 bound / 40 internal / 1,743 intentionally omitted / 0 unclassified
• manifest JSON validation and git diff --check pass
• regression coverage added for request query contracts, strict pagination, and fail-closed missing-linkage responses
• macOS Swift package build and full Swift test suite are delegated to the required GitHub Actions release gates