Harden local integrations and fix model downloads

[AdelEnazi1117]

What

This patch hardens Halen's local integration, plugin, logging, and release boundaries, and fixes the built-in model download failure reported by v0.3.0.

Why

• WebSocket pairing was applied to subscriptions but not request-style RPC messages. The bridge is now notification-only, authenticated during upgrade, origin-checked, bounded, and disabled by default.
• Plugin registry and archive metadata were not cryptographically authenticated. Registry bytes, archive size/hash, extraction paths, executable paths, permissions, and removal paths are now fail-closed. External plugins default to disabled and the UI describes their trust boundary.
• Trace logging could fall back to a predictable /tmp path and mirror sensitive values. It now uses a private Application Support directory, descriptor-based no-follow file handling, mode 0600, bounded in-place truncation, and redaction at sensitive call sites.
• llama.cpp and release packaging provenance relied on a movable abbreviated ref, caches, and metadata-preserving staging. Builds now use the full upstream commit, verify framework provenance and Mach-O paths, and validate both staged and mounted DMG contents.
• Built-in model URLs used Hugging Face's mutable main branch while enforcing the size and SHA-256 of older bytes. Gemma main changed, causing the exact size error in Settings and an eventual checksum failure. Both model URLs now use immutable commits while retaining exact size and SHA-256 validation.

User impact

• The built-in Gemma download resolves to the artifact Halen already pins (4,715,414,688 bytes, SHA-256 eb29c851...d52a2) and works independently of later upstream main changes.
• Browser-extension traffic and plugin installation are more tightly scoped and authenticated.
• The WebSocket bridge must be explicitly enabled and paired again because authentication moved to the WebSocket handshake.
• The store registry is intentionally empty for now because both previously advertised plugin release archives return HTTP 404. New entries require real immutable archives plus exact size/hash metadata.

Verification

• swift build --disable-keychain --disable-netrc
• Swift parse checks for all source and test files
• Focused semantic type-checks for the new security/model tests
• bash -n scripts/*.sh
• shellcheck on changed release scripts
• scripts/test-release-verifiers.sh
• JavaScript syntax checks and JSON validation
• git diff --check
• Verified both immutable Hugging Face revisions against their published content lengths and LFS SHA-256 values
• Independent security diff review found no remaining blocker

Full swift test could not run locally because this machine has Command Line Tools but not the full Xcode XCTest module. A clean local llama.xcframework rebuild is similarly Xcode-only; the source commit fetch/pin and deterministic verifier tests pass here, and CI should run the complete suite.