[CI/CD] Smoke-test the packaged desktop launch, health, and native bridge

[fettpl]

Summary

• Add a bounded production-bundle smoke test that launches the actual unpacked Electron app in isolated state.
• Verify the embedded frontend health endpoint and packaged preload/native PTY bridge.
• Fail closed on unsafe inherited process settings, bound diagnostics, and clean the complete process tree and temporary state on every path.
• Install controller contracts on clean CI runners before the desktop smoke job and keep release publication dependent on that job.

Closes #232

Design

This branch is stacked on #244 and #248 and should merge after them. The smoke harness uses a scrubbed environment, isolated user data, one abortable lifecycle deadline, exact architecture checks, bounded redacted diagnostics, and ownership-aware cleanup. The release workflow cannot publish until the packaged desktop smoke succeeds for the tested revision.

Validation

• Exact reviewed head: 0a521bfed7e7b55534f3af16eed4f7e250ba894e.
• Independent P0/P1 review: approved with no blockers.
• Desktop smoke unit suite: 46/46 passed.
• Workflow-policy suite: 74/74 passed.
• npm run check: passed.
• npm --prefix frontend run desktop:dist: passed and produced DMG, ZIP, and unpacked app artifacts.
• Strict deep codesign verification of the installed build: passed; bundle id org.local.studio.desktop.
• npm --prefix frontend run desktop:smoke: health=200, nativePty=true.
• Direct GET /api/desktop-health against /Applications/Local Studio.app with a scrubbed isolated profile: HTTP 200 with ok: true.
• Normal pre-push frontend quality/build hook: passed.
• GitHub CI and Security runs were created for the exact head and are action_required with no executable jobs, pending upstream workflow approval.

The existing persistent desktop profile reproduced the known current-main agent-runtime startup timeout; the same installed binary passed direct health under isolated state, separating that external profile condition from this change.

UI changes

None. This adds packaging, CI, and launch-health coverage only.

Risks and rollout

• Merge [CI/CD] Gate every release on the exact commit that passed CI #244 and [CI/CD] Make the CI and release toolchain immutable and reproducible #248 first.
• The smoke runs on the macOS packaging runner and is a required exact-revision release dependency.
• It verifies native PTY availability through the existing preload status bridge and never opens a terminal command.
• Controller credentials and runtime overrides are removed from the child environment; retained diagnostics are sanitized and bounded.

[fettpl]

@0xSero Exact independently reviewed and desktop-accepted head 0a521bf is ready, non-draft, and mergeable. Current-head CI (https://github.com/sybil-solutions/local-studio/actions/runs/29729771100) and Security (https://github.com/sybil-solutions/local-studio/actions/runs/29729771005) are action_required with zero executable jobs, pending upstream workflow approval; no genuine CI failure is present. Please approve the runs and review when convenient.