Launch validated XBEs from file browser

[jlawrence6809]

Summary

• launch .xbe files selected in the new file browser
• validate XBE structure and bounded header/certificate offsets before launch
• centralize DOS/device launch-path validation and exact D:\ normalization
• leave video active if launch fails so the dashboard remains usable
• harden scanner title parsing and all dynamic display text

Stack

Depends on #158. The reviewable change is the single-commit delta from 105c17f to 145db4f; until #158 merges, GitHub shows both commits against master.

Validation

• native Release CMake build and CTest
• ASan + UBSan CTest
• nxdk XBE and XISO build
• xemu: malformed XBE refusal with usable UI afterward, held-A single activation, non-XBE refusal, successful D:\default.xbe launch
• physical revision 1.4 Xbox: file navigation, non-XBE refusal, and successful E:\evoxdash.xbe launch to UnleashX
• independent design and implementation review: GO

The Nix/development-environment changes remain in a separate independent PR.