fix(launchpack): fall back to local dev runtime

[joeykchen]

Summary

• keep explicit local inputs fail-closed, then prefer verified release cache/download
• for SPX source checkouts, fall back to exact-version Engine/PCK from the first GOPATH/bin when a runtime is unpublished or acquisition fails
• validate regular non-symlink files, preserve strict explicit-manifest checks, avoid source-tree writes and implicit Godot builds
• document offline and make dev behavior

PR #1772 is already merged; this branch is based on that runnative environment fix.

Verification

• GOWORK=off go test ./...
• GOWORK=off go vet ./...
• GOWORK=off go test -race ./internal/release ./internal/launchpack ./cmd/spx/internal/command
• tutorial/05-Animation: buildlauncher and 20-second headless launcher smoke
• Coding-Course-49: runnative -headless ran 20 seconds without the SPX_PROJECT_DIR error

[fennoai]

Review Conclusion

Reviewed the complete fixed diff for runtime acquisition ordering, explicit local input fail-closed behavior, source-checkout fallback, manifest validation, file integrity checks, and cache/materialization flows. I found no actionable correctness, security, or compatibility regression introduced by this PR.

Verification completed with GOWORK=off go test ./internal/launchpack ./internal/release ./cmd/spx/internal/command and the corresponding -race test run; both passed.