feat(onboarding): manage platform prerequisites

[CompleteDotTech]

Summary

Implements the complete onboarding prerequisite and installation flow for #3922 and #3923.

• Adds a shared, typed prerequisite manifest for desktop, mobile, runtime, and capability-gated dependencies.
• Provisions a verified, user-scoped Node.js 22.18.0/npm lane from fixed nodejs.org artifacts and SHA-256 digests; Cave never requires a host Node/npm/Corepack/pnpm installation.
• Routes Coven CLI and approved npm-distributed runtimes through that managed lane with fixed argv, serialization, cancellation, redaction, post-install reprobes, and daemon verification.
• Adds platform-aware native preflight diagnostics, explicit Windows WebView2 bootstrap coverage, Linux recovery metadata, and remote-only mobile behavior.
• Removes Hermes from one-click installation until it has a fixed, hash-verifiable artifact.

User impact

Onboarding now distinguishes launch blockers, the managed local runtime toolchain, and optional capability tools. Users can review source, exact version/digest, scope, privilege, restart, and manual-recovery information before consenting to managed installation.

Validation

• pnpm build
• pnpm typecheck
• pnpm lint
• pnpm check:tests-wired
• pnpm test:conformance
• pnpm test:mobile
• focused onboarding prerequisite, managed toolchain, route, model, Coven PATH, and release-runtime tests
• cargo check --locked in src-tauri

pnpm test:app and pnpm test:api each reached existing Windows filesystem-policy EPERM failures (symlink creation and temporary-directory cleanup respectively). Their full Linux executions are required CI coverage and will be monitored here.

Closes #3922
Closes #3923