chore: integrate milestones for v0.26.0

[IvanLarinDev]

Summary

Integrates the completed M2–M4 stack into main for the v0.26.0 release:

• harden lifecycle shutdown, singleton IPC, bounded smoke tests, and runtime baseline verification
• add the approved first-run onboarding quick start
• add pinned SPDX SBOM generation, build provenance, strict checksums, and post-release asset verification
• preserve main's pinned actions/setup-dotnet@v6.0.0 in both CI and release workflows

Merge resolution

• .github/workflows/ci.yml is byte-identical to main
• relative to the stacked head, only CI/release setup-dotnet pins differ, both using the full v6.0.0 SHA
• no conflict markers or unresolved paths

Verification

• scoped format verification for all 17 changed C# files: PASS
• locked restore: PASS
• Release build: PASS (0 warnings, 0 errors)
• unit tests: 520/520 PASS
• Windows integration tests: 9/9 PASS
• framework-dependent and self-contained lifecycle smoke: PASS
• runtime baseline: 10.0.10 PASS
• vulnerability audit: 0 advisories
• actual pinned SBOM 4.1.5 generate + validate: PASS
• CI/release YAML and PowerShell 5.1 AST: PASS
• independent exact integration snapshot review: PASS with no findings or test gaps

Reviewed identity

• base: 6eb2eeb41ca788e45309c7e39c4909bd26e57557
• stacked merge head: 3de3577a097b5608f9dc675279931ac2a50c6351
• reviewed tree: b8efd6f4be4ecfb03e5edbf380270a77e91102d1
• staged diff SHA-256: 5c1342fe386158549f6dac7aeb75b2495a3d28e7748af40f3faa59c04993d805
• integration commit: 6089614b6cfd4ec42d259e06360b6fa7c4dad016

Release plan

After CI and merge, release v0.26.0 through scripts/release.ps1 (dry run first).