Harden beta setup, diagnostics, and packaging

[daredoole]

Summary

• add health-check, diagnostics-bundle, connection-quality, and guided-pairing controller flows
• enhance mwb_client doctor with state-aware health and connection quality output
• add redacted diagnostics bundle export and package it with the desktop controller
• expand RPM validation for desktop entries, icons, uinput integration, service gating, and diagnostics packaging
• document the beta user workflow in docs/beta-workflow.md

Compatibility context

• preserves PowerToys Mouse Without Borders protocol compatibility
• keeps mwb_client, mwb_tray, mwb-client.service, and existing config paths for the current beta
• keeps trusted-LAN operation over ports 15101 input and 15100 clipboard
• keeps /dev/uinput as the Linux injection path and avoids auto-enabling the user service at package install

Verification

• cmake --build build --target mwb_client mwb_tray -j2
• ctest --test-dir build -R 'mwb_client_doctor|input_latency|input_device_capabilities' --output-on-failure\n- scripts/validate-rpm-packaging.sh\n- MWB_VALIDATE_RPM_BUILD=1 scripts/validate-rpm-packaging.sh\n- git diff --check\n- diagnostics bundle smoke test with redaction check

[daredoole]

Follow-up roadmap issue created for the topology/session-validation work that builds on this PR: #10. Keeping it separate so this PR remains focused on beta hardening, diagnostics, and packaging.