fix: preserve CardputerZero settings and release workflows

[liuhao-1997]

Summary

• preserve ExtPort and ADB settings across power cycles and recover ADB after USB reconnects
• remove manual date/time setup while preserving the remaining OOBE flow
• restore CLI paging shortcuts and unmute before volume-key adjustments
• use packaged JetBrains Mono for ZClaw's ambiguous Latin/digit glyphs
• keep Settings prompt sounds while preventing rapid page entry/exit from repeatedly tearing down the audio stream
• make Update actions authorized, bounded, rollback-capable, and package local/cloud Launcher payloads through one script

Factory sync and conflicts

This branch is based on current CardputerZero/launcher@c92874968507 (ahead=0, behind=0 before these commits). The earlier local audio lifecycle branch was already absorbed by upstream PR #138 and was not replayed. No unresolved merge conflict remains.

The only factory-sync text conflict in the wider image stack was in pi-gen/stage2/05-cardputerzero/01-run.sh; that is handled in the separate pi-gen PR by retaining the upstream script and adding an isolated ExtPort permissions patch. This Launcher PR does not revert LightDM, DAPM, camera, font-package, or other factory changes.

Dependency

Depends on m5stack/M5Stack_Linux_Libs#11. That PR passes SOURCE_DATE_EPOCH into GCC from the SDK SCons environment. After it merges into UserDemo, this branch still needs one follow-up commit updating the SDK gitlink to the merged upstream commit. Do not merge this PR before that gitlink update: without it, runtime functionality builds, but local/cloud package reproducibility is not guaranteed.

Validation

• focused ExtPort, OOBE, ADB, CLI, media, updater, and audio quiet-period tests passed
• local/prerelease/local full clean package build completed; both local .deb files were byte-identical
• package contains all five ARM64 product ELF files and cardputer-adb-hotplug; update ABI is 1 and SHA-256 verifies
• board package upgrade preserved every file hash under /home/pi/.config; APPLaunch remained active with one PID and NRestarts=0
• user confirmed normal prompt sounds remain and the previously reproducible Settings buzz is gone; rapid navigation may still expose the existing factory Loading... page template

Full image construction and offline verification run separately in pi-gen. Fresh-media OOBE, cold-start performance, display, audio listening, and hardware regression still require device validation before release.