fix: harden release and runtime installs

[loonghao]

Summary

• Skip empty cargo-dist dependency-install steps and normalize apt installs with portable awk
• Serialize runtime install verification so concurrent installs cannot treat a half-extracted executable as ready
• Keep workspace-hack lockfile metadata current

Validation

• vx actionlint .github/workflows/release.yml
• vx cargo fmt --all
• vx cargo test -p vx-runtime --test install_lock_tests
• vx git diff --check

Notes

• The Windows CI failure was a runtime install race: a second vx process could see node.exe before the first archive extraction finished, then Windows reported os error 193.