feat: owner Pro+ allowlist via CloudKit, cut v5.0.1v5.0.1

Grants the app owner Pro+ without a purchase, keyed to their CloudKit
user-record ID so it works on the release App Store build.

- OwnerAccess holds the owner's CloudKit user-record ID (opaque, per-Apple-ID,
  scoped to the app's container; safe to publish — CloudKit verifies identity
  server-side, so it can't be presented by anyone else).
- PurchaseService resolves the allowlist against CloudKit once per launch and,
  on a match, records a persisted owner grant so it applies instantly and
  offline thereafter. The grant only ever elevates the tier to .proPlus and
  defers to the existing #if DEBUG overrides, so real purchases and free/pro
  testing are unaffected. cachedTier / cachedEntitlement were refactored to
  fall back to the owner grant only when no debug override or stored purchase
  applies.
- Supersedes the DEBUG record-ID reveal (PR #60): its only purpose was to read
  the owner's ID, which is now hardcoded, so the reveal is not shipped.

Release cut: MARKETING_VERSION 5.0.0 -> 5.0.1, CURRENT_PROJECT_VERSION 45 -> 46,
AppVersion.current -> 5.0.1, roadmap updated. App builds clean; unit suite 63/63.

1 files changed, 12 insertions, 1 deletions

diff --git a/RELEASE_ROADMAP.md b/RELEASE_ROADMAP.md
index 3b46d32..eeb3350 100644
--- a/RELEASE_ROADMAP.md
+++ b/RELEASE_ROADMAP.md
@@ -6,7 +6,7 @@ ports, geolocation, subdomains, availability). The next several releases invest
 in *reach and surfacing* — getting that data onto more iOS surfaces and into more
 workflows — rather than adding raw protocol checks.
 
-Current version: `v5.0.0`.
+Current version: `v5.0.1`.
 
 ## v4.4.1 Patch: Release Readiness — ✅ shipped
 
@@ -310,6 +310,17 @@ Release cut: `MARKETING_VERSION` 4.9.0 → 5.0.0, `CURRENT_PROJECT_VERSION`
 44 → 45, and `AppVersion.current` bumped in lockstep. App Store archive/submit is
 the only step left, and it is a manual action outside the repo.
 
+## v5.0.1 Patch: Owner entitlement — ✅ shipped
+
+- **Owner Pro+ allowlist.** `OwnerAccess` identifies the app owner by their
+  CloudKit user-record ID (an opaque, per-Apple-ID value scoped to the app's
+  container). `PurchaseService` resolves it against CloudKit once per launch and,
+  on a match, grants `.proPlus` — persisted so it applies instantly and offline
+  thereafter. It only ever elevates the tier and defers to the existing `#if
+  DEBUG` overrides, so real purchases and free/pro testing are unaffected.
+- Release cut: `MARKETING_VERSION` 5.0.0 → 5.0.1, `CURRENT_PROJECT_VERSION`
+  45 → 46, `AppVersion.current` in lockstep.
+
 ## Cross-cutting note
 
 New feature surfaces (widgets, intents, extensions) each add a target and a