fix(release): keep Desktop and CLI Runtime Host artifacts compatible

[CxHsin]

Summary

Fixes #3973

Desktop 0.1.11 embeds Runtime Host compatibility epoch 25, while maka-agent@0.1.0-beta.1 advertises epoch 24. The release pipeline could publish artifacts that were individually valid but could not interoperate over the Runtime Host handshake.

This change carries one makaReleaseIdentity through Desktop, npm CLI, and macOS CLI artifacts, then validates it during packaging and smoke checks.

Root cause

The Desktop and npm CLI release paths did not bind the exact Runtime Host protocol compatibility epoch and source identity into the published artifact. A Desktop client and a remote maka-agent host from different epochs could therefore pass independent release checks and fail only at runtime.

Changes

• Add a shared makaReleaseIdentity containing schema version, product version, exact source commit, and Runtime Host compatibility epoch.
• Propagate the source commit and release identity through Desktop nightly/release, CLI, and macOS CLI workflows.
• Validate installed artifacts and packaged Desktop/CLI hosts against the source identity and Runtime Host protocol epoch.
• Add a cross-artifact Runtime Host handshake smoke test that accepts a matching epoch and rejects a mismatched epoch before Domain command admission.
• Add compatibility tests and update the English and Chinese release documentation with the supported Client/Host matrix.
• Document the immutable npm release requirement: do not overwrite 0.1.0-beta.1; publish a new matching release from one approved source commit.

Verification

• 121 compatibility, packaging, release, CI, and artifact tests passed.
• Biome passed.
• ASF header checks passed.
• git diff --check passed.
• scripts/product-release.test.mjs retains one pre-existing Windows-local bash-path failure, unrelated to this change.

Review focus

• Confirm that the release identity uses the canonical Runtime Host protocol epoch.
• Confirm that CI source-commit overrides prevent validation from falling back to a workspace HEAD.
• Confirm that handshake rejection occurs before Domain command admission.
• Confirm that Desktop, npm CLI, and macOS CLI release paths all carry and validate the same identity.

AI use

Codex was used to inspect the issue, implement the release identity propagation and validation, add tests and documentation, and run verification. The resulting changes were reviewed against the repository contribution requirements.

Checklist

• Tests added or updated
• Documentation updated
• Verification completed
• ASF headers and formatting checked
• No unrelated working-tree changes included