P0 Phase-L: add one-command local demo launcher

[gnanirahulnutakki]

Problem

The completed Phase-L product has three entry surfaces (sith, sith ui, and sith desktop) but no obvious one-command graphical launch path. This makes a healthy, feature-complete local client feel unfinished during first-run and demo use.

Scope

Add sith launch as orchestration over the existing local surfaces. It must not create another UI, deploy fixtures, persist kubeconfig paths, or change the local-versus-governed action boundary.

Acceptance criteria

• sith launch selects the native desktop on macOS and the loopback-only web UI on other supported platforms.
• --mode auto|desktop|ui provides an explicit override and rejects unknown values.
• --kubeconfig-dir reuses the existing bounded, in-memory directory importer.
• UI-only listener/browser flags remain explicit and are rejected when desktop mode is selected rather than silently ignored.
• Missing backends, unsupported desktop platforms, invalid paths, and cancellation fail safely with sanitized errors.
• Unit tests cover mode selection, invalid combinations, dependency validation, and command registration.
• README first-run and demo guidance leads with sith launch.
• No workload, credential, telemetry, external listener, or cluster mutation is introduced by the launcher itself.

Verification

• Focused race tests for internal/cli.
• Full make ci.
• Local launch smoke using an isolated kubeconfig-directory fixture.

Refs #29 #34 #166 #27.

[gnanirahulnutakki]

Completed by PR #316 and merged into dev as verified merge commit c77176454d4fe66555f443f9625699ee56c53d5f.

Closure evidence:

• sith launch selects native desktop on macOS and loopback UI elsewhere, with explicit --mode desktop|ui;
• bounded --kubeconfig-dir import works without a default kubeconfig backend and does not persist or deploy anything;
• focused race/stress tests, full local CI, isolation, Helm, OCI, real two-Kind-cluster, and reproducible release gates passed;
• real loopback smoke against the provided self-managed kubeconfig directory returned HTTP 200 and exited cleanly;
• exact post-merge CI: https://github.com/ArdurAI/sith/actions/runs/30033478742 — success;
• exact post-merge CodeQL: https://github.com/ArdurAI/sith/actions/runs/30033477830 — success;
• security queues: Dependabot/code scanning/secret scanning = 0/0/0.

No shared-cluster workload was created, so no tenant node-selector policy was invoked.