feat(supply-chain): add runtime package audit

[luoye520ww]

Summary

• Re-submit the useful runtime half of feat(supply-chain): audit marketplace installs #671 after fix(marketplace): pin and validate MCP package installs #673 was merged.
• Add authenticated runtime endpoints for package supply-chain audit and update policy checks.
• Keep this scoped away from fix(marketplace): pin and validate MCP package installs #673: no Marketplace UI changes and no repeated package pinning changes.

Changes

• Adds a pure supply-chain audit module for exact-version checks, downloaded-byte SHA-256 verification, runtime-owned publisher signature verification, sensitive permission consent, and update decisions.
• Adds a runtime-owned publisher trust store abstraction that fails closed when no trusted key is configured.
• Exposes POST /v1/supply-chain/audit and POST /v1/supply-chain/update-check, and models them in the main IPC runtimeRequest allowlist.

Why this differs from closed #671

#671 mixed runtime audit APIs with Marketplace install changes. #673 already merged the enforceable Marketplace package pinning / config validation part. This PR deliberately does not audit the renderer MCP config text as if it were downloaded package bytes; the runtime audit only verifies actual provided package bytes and runtime-owned publisher keys.

Tests

• npm.cmd --prefix kun test -- package-audit.test.ts publisher-trust-store.test.ts supply-chain.test.ts
• npm.cmd test -- src/main/ipc/app-ipc-schemas.test.ts
• npm.cmd --prefix kun run typecheck
• npm.cmd run typecheck
• focused eslint
• npm.cmd --prefix kun run build
• git diff --check

[XingYu-Zhong]

Reviewed locally. Focused supply-chain audit, trust-store, and IPC schema tests passed; no blocking issues found.