feat: add deterministic cross-platform GUI installer support

[ian-pascoe]

Summary

• Add first-class installer artifact support across platforms (msi, dmg, appimage, exe, pkg, deb, rpm, msix, appx) with deterministic extraction, explicit host guards, and actionable fail-closed errors.
• Implement GUI app exposure and native registration lifecycle wiring (launcher/assets projection, best-effort native registration warnings, state tracking, uninstall/replacement cleanup, and collision hardening).
• Expand test coverage across core/installer/CLI for archive parsing/inference, host-guard contracts, extraction command paths, and update architecture/install/manifest docs for the new policy surface.

Test Plan

• cargo fmt --all --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace
• scripts/validate-snapshot-flow.sh

[ian-pascoe]

@codex review for bugs and security issues

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8ec432b42b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Resolve DEB artifact path before changing extraction directory

stage_deb_payload constructs ar x <artifact_path> <member> and then switches the command working directory to extract_dir; when artifact_path is relative, ar resolves it from extract_dir and cannot find the archive, so .deb installs fail before payload unpacking. This is reachable whenever callers pass relative paths (for example, relative prefix/cache roots), so the DEB path should be absolutized (or the command should run from the original cwd) before current_dir is set.

Useful? React with 👍 / 👎.