fix: enforce open-limit rules proactively in the foreground

RuleEnforcer.refresh only shielded a limit rule once its budget was
spent, so it tore down the background's proactive open-limit "turnstile"
shield (the shield is how opens are counted) whenever the app was
foregrounded, and a freshly created open-limit rule did nothing until
the next midnight reset.

refresh now applies the same proactive gate as
LimitEnforcement.handleDayStart: an enabled, scheduled-today, un-paused
open-limit rule is shielded even before its budget is spent, so it takes
effect immediately. A new app-group OpenSessionStore records a granted
"Open" session's expiry so neither enforcement path re-shields (and cuts
short) a sanctioned ~15-minute session.

Overlapping rules already enforce strictly: each rule shields its own
ManagedSettingsStore and Screen Time unions them, so an app is blocked
if any covering rule blocks it. Document that model in the spec (§4.8)
and lock it in with tests, including a time limit blocking during an
open-limit's granted session and a daily opens reset.

Shared/LimitEnforcement.swift

@@ -13,6 +13,8 @@ struct LimitEnforcement {
     let snapshots: RuleSnapshotStore
     let ledger: UsageLedger
     let shields: ShieldApplying
+    /// Granted-open session bookkeeping shared with the foreground enforcer.
+    var sessions = OpenSessionStore()
 
     /// Midnight (or monitoring start): fresh budgets. Open-limit rules are
     /// proactively shielded on enabled days so the shield can count opens;
@@ -62,6 +64,7 @@ struct LimitEnforcement {
     func handleOpenSessionEnded(
         ruleID: UUID, now: Date = .now, calendar: Calendar = .current
     ) {
+        sessions.endSession(for: ruleID)
         guard let snapshot = snapshots.snapshot(for: ruleID), snapshot.isEnabled,
               snapshot.kind == .openLimit,
               !snapshot.isPaused(at: now),
@@ -84,6 +87,13 @@ struct LimitEnforcement {
         guard !snapshot.limitReached(given: usage) else { return false }
         ledger.recordOpen(for: ruleID, onDayContaining: now, calendar: calendar)
         shields.clearShield(ruleID: ruleID)
+        // Mark the session so neither enforcement path re-shields the app until
+        // it ends (+1 minute matches the one-shot activity's padding).
+        if let expiry = calendar.date(
+            byAdding: .minute, value: MonitoringPlan.openSessionMinutes + 1, to: now)
+        {
+            sessions.startSession(for: ruleID, until: expiry)
+        }
         return true
     }