Make StartOS release builds runner-safe

[keegreil]

Summary

• work around Start CLI 1.1.0 eagerly resolving host.default during offline package construction
• preserve the pinned CLI, image lock, architecture matrix, checksums, SBOM, and GitHub provenance flow
• increment the package revision to 0.2.2:3

The workaround changes only the ephemeral CI workspace host from the unresolvable dev-vm.local default to a resolvable endpoint. Package construction does not invoke a StartOS host API. Both architectures were also built and inspected locally from this exact source.

Validation

• TypeScript check and package procedure build
• immutable image verification
• dependency audit
• local x86_64 and aarch64 S9PK construction and manifest inspection