[Maintenance] Replace the deprecated unpinned GitHub MCP package

[fettpl]

Summary

• Replaces the deprecated registry-resolved GitHub MCP connector with GitHub's official v1.6.0 server, pinned by exact archive and executable SHA-256 for every supported OS/architecture.
• Adds explicit install/status management, bounded archive parsing, crash-safe multi-process installation, atomic rollback, private permissions/ACL verification, and exact pre-spawn executable validation.
• Runs GitHub in read-only mode with the reviewed repos,issues,pull_requests toolsets and a fixed 22-tool inventory while preserving the private Electron management boundary.

Root cause and design

The catalog previously launched npx -y @modelcontextprotocol/server-github, so execution depended on mutable registry state and the deprecated package exposed no repository-owned artifact identity. This change checks immutable official release metadata into source, streams downloads under exact byte/time limits, verifies the archive before bounded extraction, verifies the executable again before use, and promotes only a startup-verified candidate under an inter-process ownership lock. Interrupted promotion restores the prior working install.

Legacy migration recognizes only the exact historical generated shape. Originless custom wrappers remain untouched; absolute npx paths are adopted only when a prior catalog origin proves Local Studio ownership. Managed connectors are rebased across supported platform/data-directory changes with credentials preserved but grants cleared for review.

Dependency

This PR is stacked on #256 at 4929d315c1fd7e13830cb3213e96644d744d8e3a and should merge after it.

Acceptance outcomes

• No live GitHub connector invokes npx or an unversioned package.
• All five supported release archives and executables have repository-owned version, size, URL, and SHA-256 metadata.
• Unsupported targets, hash/size mismatch, traversal/symlink entries, malformed archives, interruption, timeout, unsafe permissions, and failed promotion fail closed without replacing a working install.
• The runtime revalidates exact path, ownership/mode or Windows ACL, directory contents, size, SHA-256, launch arguments, and tool inventory before execution.
• The default server is read-only and exposes exactly the reviewed 22-tool surface.
• Exact historical catalog configurations migrate predictably; customized originless configurations remain byte-for-byte unchanged.
• Browser installation requires authorized same-origin JSON, while the embedded desktop uses typed private IPC and denies the HTTP management path.

Validation

• Exact independently reviewed head: 01ac7ff18f1097da281f4603e77d751568e130be.
• The official Darwin arm64 archive was independently downloaded at 7,644,753 bytes and matched SHA-256 cdce71ef6f893d463910678ec298bba76610ca4591bf35263f0ff0ec35928f9e.
• The extracted official executable was 23,627,042 bytes and matched SHA-256 60e178495ae2bcb898eaffc2c21d299d553a259914430c9eaa8b3f5f76f5d129.
• The opt-in real-release production install suite passed 23/23 at the exact head.
• Direct real-binary capture deep-matched all 22 digest-relevant tool records to the checked fixture and reproduced inventory digest sha256:c1cf11fc3b7cdf3afd1301bf38bc6c8a9bbd5357ca50baa2ec175ac89c144772.
• The checked fixture matched file SHA-256 bc0a4a4164c8ec78758783b539b2a2093096d491620217bb180fc878f3de0f16.
• npm run check: passed the full repository gate at the exact head.
• Guarded push pre-push npm --prefix frontend run check:quality: passed, including production build.
• git diff --check 4929d315c1fd7e13830cb3213e96644d744d8e3a 01ac7ff18f1097da281f4603e77d751568e130be: passed.
• Production desktop:dist passed afterPack and afterSign; the canonical app reinstall, deep strict code-signature verification, launch, and GET /api/desktop-health HTTP 200 acceptance passed at the exact head.
• Independent P0/P1 review found no remaining blocker at the exact head.
• Exact-head CI and Security runs are action_required with zero jobs; an upstream maintainer must approve the fork workflows before GitHub can execute them.
• The root package does not define a separate test:integration script; the available full repository and real-artifact suites above were run.

Closes #234

[fettpl]

@0xSero Exact head 01ac7ff18f1097da281f4603e77d751568e130be is independently P0/P1-approved. The official Darwin arm64 archive/executable matched their pinned sizes and SHA-256 values; the real-release production install passed 23/23; direct capture deep-matched all 22 tool records and the pinned inventory digest. Full repository, pre-push, production packaging, canonical reinstall, code-signature, and desktop health 200 gates passed. Exact-head CI and Security are awaiting fork-workflow approval (action_required, zero jobs). Please approve the workflows and review when ready.