macOS: honor the CheckFilesystem repair flag (#1791)

CoreMacOSX::CheckFilesystem() ignored both its mountedVolume and repair
arguments and always just launched Disk Utility.app, so the "Check
Filesystem" and "Repair Filesystem" menu items behaved identically and
neither acted on the mounted volume. On Linux/BSD the same operation runs
fsck and honors the flag (passing -n only when repair is false).

Run diskutil on the VeraCrypt virtual device, choosing verifyVolume or
repairVolume per the flag (diskutil unmounts the inner filesystem itself
as needed). The Core layer has no GUI, so the result is shown in a
Terminal window via a temporary .command script; it falls back to
launching Disk Utility.app when no virtual device is available.

Run the macOS check in the unprivileged application process. VeraCrypt does
not need to create or launch the helper script from the elevated core
service: diskutil operates on the mounted virtual device and macOS handles
any device authorization requirements. Once a device-hosted mount has
started the elevated core service, every later service request is routed to
that root process. There it would create the helper script as root (0700)
and open a Terminal in the GUI session that the user could neither read nor
execute. CoreServiceProxy::CheckFilesystem now invokes the core
implementation directly on macOS instead of sending a service request, so
the script is always owned by the GUI user.

The device path is strictly validated as /dev/[r]diskN[sM] before being
single-quoted into the command. The helper script is created securely in
the per-user temp directory via mkstemps() (atomic O_EXCL/0600, fchmod
0700 by descriptor, close() checked for deferred write errors, unlinked on
any failure) rather than at a predictable, enumerable path in the
world-writable /tmp, guarding against a symlink/race on the executed
script. A trap removes the script on exit even if the window is closed
early, and it is also unlinked if launching Terminal fails. The script
captures $? so diskutil's result, including failures, is shown before the
script exits.

Replace the macOS pre-check message (which still told the user Disk
Utility would open and to pick Verify/Repair manually) with check- and
repair-specific text describing the new automatic diskutil flow.

Seed the two new strings into all translation files with the English
text so the XML key-completeness check passes; localization can follow.

Co-authored-by: Damian Rickard <damian@rickard.us>

Translations/Language.zh-hk.xml

@@ -1498,6 +1498,8 @@
     <entry lang="zh-hk" key="LINUX_REMOUNT_BECAUSEOF_SETTING">請注意在可以使用這項設定之前需要重新掛載現正已掛載的加密區。</entry>
     <entry lang="zh-hk" key="LINUX_UNKNOWN_EXC_OCCURRED">發生未知的例外情況。</entry>
     <entry lang="zh-hk" key="LINUX_FIRST_AID">"磁碟工具將會在按下 [確定] 之後啟動。\n\n請在磁碟工具中選擇你的磁碟區，然後在 [救援] 頁面中按 [檢查磁碟] 或 [修復磁碟]。</entry>
+    <entry lang="en" key="MACOSX_CHECK_FILESYS">A Terminal window will open after you press 'OK' and check the file system on the selected VeraCrypt volume using 'diskutil'. The result will be shown in that window.\n\nIf the check cannot be started, Disk Utility will be launched instead.</entry>
+    <entry lang="en" key="MACOSX_REPAIR_FILESYS">A Terminal window will open after you press 'OK' and attempt to repair the file system on the selected VeraCrypt volume using 'diskutil'. The result will be shown in that window.\n\nIf the repair cannot be started, Disk Utility will be launched instead.</entry>
     <entry lang="zh-hk" key="LINUX_MOUNT_ALL_DEV">掛載所有裝置</entry>
     <entry lang="zh-hk" key="LINUX_ERROR_LOADING_CONFIG">載入設定檔案時發生錯誤位於</entry>
     <entry lang="zh-hk" key="LINUX_SELECT_FREE_SLOT">請在列表中選擇未使用的磁碟機位置。</entry>