fix: complete managed runtime downloads on slow connections

[SunChJ]

Summary

• split the live BabelDOC transport into a short-lived metadata session and a long-running archive session
• keep metadata at 12 seconds per request / 60 seconds total, while runtime archives use 60 seconds inactivity / 1 hour total
• preserve the existing ephemeral(policy:) behavior for callers that explicitly provide one policy
• add an opt-in CLI smoke that validates the public signed runtime end to end without opening the App
• bump Gloss to 0.8.1 (build 9) and add release notes

Root cause

The managed runtime used one ephemeral URLSession for both the small signed manifest and the 228,709,309-byte runtime archive. Its 60-second resource timeout was appropriate for metadata but terminated the archive after exactly one minute. The manifest and detached signature had already downloaded and verified successfully; only the large asset timed out.

User impact

A first-time PDF user could open and preview a PDF, but the managed runtime never became ready and translation stayed disabled. Existing verified runtime installations were unaffected. With this change, a slow connection may continue downloading while a stalled connection still fails after 60 seconds without data.

Validation

• Scripts/smoke_babeldoc_runtime.sh: passed against the public arm64 0.6.4+gloss.4 release in 1,766.952 seconds
  • verified manifest signature, declared size, SHA-256, extraction, executable permissions, activation, persistence, and state restoration
• swift test --parallel: passed
• swift test: 171 XCTest tests, 4 opt-in skips, 0 failures; 26 Swift Testing tests, 1 opt-in skip, 0 failures
• swift format lint --strict on both changed Swift files
• bash -n Scripts/*.sh
• swift package describe
• plutil -lint Resources/Info.plist
• git diff --check