Freeze artifact app action manifests

[atrium-alpha-agents]

Summary

• add artifact-app-action-proxy-design.md and artifact-apps-centaur-connector-addendum.md
• add app_version_actions so action declarations from atrium.app.json are frozen per published app version
• validate manifest action names/policies/schemas at publish time and expose frozen actions from app launch
• update web API types and app tests for the new launch/publish contract

Prompted by: Allan Niemerg (@allan)

Validation

• git diff --check
• attempted pnpm --dir surface/server test apps.test.ts and pnpm --dir surface/server typecheck; both were blocked before running tests by package-manager registry fetch failures (registry.npmjs.org/pnpm / @pnpm/exe) in this sandbox

[github-actions]

Thank you for your contribution! Before we can accept it, we ask that you sign our Contributor License Agreement. You can sign by posting the comment below. If you are contributing on behalf of your employer, your employer may also need to sign the Corporate CLA — see that document for how.

---

I have read the CLA Document and I hereby sign the CLA

---

Centaur AI seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}