Prove packaged macOS and Windows startup before release

[yaacovcorcos]

Summary

• add a renderer main-frame success marker so release verification cannot pass merely because Electron constructed a window
• launch the exact collected macOS and Windows release payloads before artifact upload
• require app, window, backend, and renderer readiness followed by a stability window
• isolate Scient state and allowlist inherited host environment variables
• fail if startup exits early and prove packaged root/backend process-tree cleanup

Why

The existing release checks could report success after BrowserWindow construction even when the renderer, preload, or packaged assets failed to load. This adds an exact-payload native startup gate for the currently shipped macOS and Windows artifacts.

Scope

This is intentionally limited to macOS and Windows startup proof. It does not include the deferred Linux AppImage/.deb, AppArmor, updater-channel, or distribution-policy work from #58.

Validation

• bun run fmt:check
• bun run lint (0 errors; existing repository warnings only)
• bun run typecheck
• bun run test (all 12 Turbo tasks)
• bun run build
• bun run release:smoke
• bun run workflow:check
• focused verifier tests: 14/14
• git diff --check

The exact native payload launch runs on the corresponding macOS and Windows release builders.