Release v4.20.0

A host can approve custom runtime packages with one document that the CLI, Stage and a React host all read, and the React host loads exactly what was approved.

Added

• ApprovedPackageSet / ApprovedPackageSetJson (Cratis.Scene.Engine): the approved package set document (manifest + module per package). Read validates it - unknown members, document version, names the host already ships, duplicates, icon libraries, invalid npm names/exports, URL or foreign style sheets - and Catalog gives planning the manifests without loading code; Write is canonical. See Approved package sets. (part of #75)
• loadApprovedPackages and resolveApprovedPackageHost (@cratis/scene.react): load the set's bundles through an explicit map of literal import()s, only when the host policy allows executable imports, refuse a bundle that differs from its declaration, and block the host with a diagnostic when a package is missing, fails to import or lacks its export. Packages load in ordinal name order. (part of #75)