Add native Windows and Linux releases

[w00c00]

What changed

• replace Bash-only SilverScript and Kascov helper builds with cross-platform Node.js scripts
• wire Windows .exe helper paths through manifests, the packaged runtime, and the Tauri sidecar
• remove the installed application's Python dependency by porting heuristic covenant triage to JavaScript
• add native macOS arm64, Windows x64, and Linux x86_64 build jobs
• stage DMG, NSIS, MSI, DEB, and AppImage packages with SHA-256 manifests
• bump the application to v0.2.1 and add bilingual release notes and platform-signing disclosures

Why

The previous desktop runtime was only release-validated on macOS. Its setup scripts required Bash, Windows helper executables were not resolved with .exe, and contract compilation invoked an unbundled python3 process. Those gaps could produce an installer whose covenant compile or local-preflight workflow failed on a clean Windows machine.

Local verification

• npm run setup:silverc: both pinned compiler commits built from source
• npm run setup:kascov-preflight: pinned Kascov preflight engine built from source
• npm run verify: 37/37 tests passed, syntax checks passed, Vite production build passed
• cargo fmt --check: passed
• v0.2.1 macOS arm64 DMG built, mounted read-only, and verified
• packaged .app passed strict deep code-signature verification
• packaged runtime contains all three arm64 native helpers

Release boundary

The GitHub Release will be created only from the v0.2.1 tag after all native Runner jobs succeed. Windows packages are not Authenticode-signed, Linux packages are not distribution-signed, and macOS is ad-hoc signed without notarization.

SilverScript and the KCC721 pack remain experimental and TN10-first. KCC721 standalone and mainnet deployment remain blocked.