feat: ship launch surface and guarded workspace release flows

[Z3r0DayZion-install]

Summary

• add launch-surface and channel automation assets for WinGet, Microsoft Store screenshots, docs site prep, and related submission packets
• add guarded workspace attach, preview/apply, patch-plan staging, verification run plans, release cockpit history, and workflow-scoped palette shortcuts
• align the preload/main IPC bridge for verification:run, clear stale workspace-bound patch and verification plans on root changes, and allow common filenames like My Notes.md
• expand validator, session, and state coverage for the new persisted workflow surfaces and refresh the source integrity manifest for the committed tree

Verification

• npm run lint
• npm test
• npm run coverage:check
• npx playwright test -c playwright.e2e.config.js e2e/ui-founder-flows.spec.js
• pre-push gate passed: npm run release:worktree, npm run lint, npm run test:flaky, npm run coverage:check, npm run security:pass:local

Notes

• this PR now includes the earlier launch/channel asset work plus the guarded workspace and release workflow branch work
• the source integrity manifest was regenerated after the intentional code and test changes so the security gate matches the committed tree