feat(packaging): enforce the four-binary native payload

[sandersonstabo]

Depends on #350.

Enforces the native version payload as exactly four versioned binaries under bin/: ae, installer, editor, and forge (with .exe on Windows). Only resources/ and licenses/ are optional; extra binaries, component directories, and legacy Broker/Node/Electron/host layouts are rejected by both manifest generation and CLI verification.

Coverage includes every required binary, wrong-platform names, extra bin members, optional-tree hashing, unsafe manifest entries, legacy layout rejection, and bounded diagnostics.

Checks: 13-target jobs=1 Bazel build; CLI and installer unit suites plus four packaging suites (6/6 targets); 11 fresh strict Clippy markers; exhaustive root Rust format gate; cargo metadata --locked --offline; deterministic archive SHA-256 and stable guarded hashes; Bazel shutdown 0.

Excludes launch/control behavior, installer retirement, and conversation/Statig source.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Enforces the native payload as exactly four versioned binaries under bin/ (ae, installer, editor, forge, with .exe on Windows); previously the manifest covered any regular file present. Only resources/ and licenses/ are optional now, and their files must be non-executable. Both manifest generation and CLI verification reject extra binaries, component directories, and legacy Broker/Node/Electron/host members.

Scope

• Excludes launch/control behavior, installer retirement, and conversation/Statig source.

^{Written for commit 39a5604. Summary will update on new commits.}