[alexanderdibenedetto]

Fixes from a repo audit and from review feedback on #378.

Behavior changes

• A malformed TSKExpirationDate now throws. A value that wasn't a yyyy-MM-dd string used to be dropped, so the pins never expired. It now raises the same "TrustKit configuration invalid" exception as other config errors.
• TSKExcludeSubdomainFromParentPolicy works in Info.plist. The constant's value was misspelled as kSKExcludeSubdomainFromParentPolicy, so the documented key was ignored. The app then failed at launch with the "less than 2 pins" error. Code that uses kTSKExcludeSubdomainFromParentPolicy is unaffected. An Info.plist that uses the misspelled string must be renamed.
• macOS: user-installed roots when TSKIgnorePinningForUserDefinedTrustAnchors is NO. These are now handled like any other pin mismatch: the connection is blocked only when TSKEnforcePinning is YES, and a report is sent either way. Before, they were always blocked and never reported.
• Swizzling no longer skips delegates whose class name starts with TSK. The check now matches TrustKit's own classes: TSKBackgroundReporter and TSKNSURLSessionDelegateProxy for sessions, and TSKNSURLConnectionDelegateProxy for connections. The proxy c being wrapped twice when the swizzle is installed more than once, as the tests do.

Cleanup

• Remove +[TSKPinningValidator allowsAdditionalTrustAnchors] and its unused test subclass. Nothing has called this since anchors were removed in document limitations of TSKAdditionalTrustAnchors on iOS 11 #154.
• Remove `scripts/install_sis CI step (reviewcomment).
  It never fixed the watchOS rmage. watchOS goes back into the test matrix once [macOS] xcode-27-arm64: duplicate watchOS 27.0 runtime actions/runner-images#14946 is fixed.

Docs

• The report's app-vendor-id is now documented as a random UUID that TrustKit generates once per install. nce 3.0.1.
• Add TSKExpirationDate to the configuration key table in TrustKit.h, and say
  that any other value is a co
• Replace the Info.plist screenshot, which still showed TSKPublicKeyAlgorithms,
  with one using the demo app'
• The generated API docs are also stale. That's tracked separately in Generate the API docs in the release workflow instead of committing them #379.

Not changed

• Pinned-domain keys that differ only by case, a trailing dot or IPv6 notation still throw (review comment). It's a config error, and silently picking one policy would hide it. The 4.0 release notes list it as a breaking change.

Tests

• New tests:
  • Malformed expiration dates are rejected.
  • The exclude-subdomain constant has the documented value.
  • On macOS, a report is sent for a user-installed root when the bypass is off.
  • An app delegate whose name starts with TSK is still proxied.
• The existing test that a bypassed user-installed root sends no report now uses a strict mock, so it fails if a report is sent.