feat: harden operator apps and release checks

[temiroff]

Summary

• scope packaged-App file browsing to declared extensions and configured host roots
• validate the full operator-view v1 contract and sandbox embedded viewers
• add Vitest component/contract tests and a Playwright packaged-App flow
• lazy-load heavy panels; initial JS falls from ~1.14 MB to ~481 KB
• replace Rust async raw-pointer sharing, fix exact cycle-edge rollback, and add runtime/core/value tests
• add merged-source-lock validation and a coordinated lock-update workflow
• run editor tests and full Rust tests in CI

Verification

• python -m unittest discover -s tests (592 passed, 8 skipped)
• CI python -m pytest (all 852 collected tests pass; 13 skipped)
• npm test (11 passed)
• npm run test:e2e (1 Chromium flow passed)
• npm run build (clean; no large-chunk warning)
• cargo test --workspace --all-targets (7 passed)
• python scripts/update_device_source_lock.py --verify-merged

Managed Runtime release decision

The core portion is editor/server, tests, release tooling, and an unused Rust prototype path, so it does not alter the managed device bundle. The Newton extension change is released separately and does require a Runtime patch as the operator-visible update trigger; that Runtime release and the final merged-SHA lock PR will follow.