Workshop v0.9.1 activation and NanoHorizon starter

[JoshuaPurtell]

Summary

• makes Synth activation one-click and navigation-safe
• adds truthful connected-account, entitlement, allowance, and expiration state
• preserves research starter intent through browser pairing and deep-link return
• adds bounded Craftax and NanoHorizon first-run starters with terminal result, trace, visual, and next-action surfaces
• pins NanoHorizon to the anonymous public starter revision aba3dfb7c7e77ddee0cc5686f636355f166dc910 and requires setup/preflight before Docker or provider work
• stabilizes release gates under load and removes private-link dependencies from the public export

Verification

• starter catalog tests: 3 passed
• desktop TypeScript: passed
• clean stable v0.9.1 build from 57232ec: passed
• ZIP round-trip extraction, SHA-256, ad-hoc signature, bundle/version, arm64, synth-workshop scheme, and embedded public starter: passed
• internal draft prerelease contains the exact 143,887,485-byte pre-notary ZIP with SHA-256 1e3949582c26a296ed5ba9536c57eddfeb6d847966a06849537166f53e362383

Deferred release gates

• Developer ID signing, notarization, and stapling: identity unavailable
• timing-sensitive performance acceptance and canonical isolated launch: two pre-existing Workshop processes are consuming about 230% CPU and were not terminated
• paid five-seed NanoHorizon run: requires explicit approval for up to $2.45
• public stable publication: prohibited for the ad-hoc/unnotarized candidate

Base is the public v0.9.0 release branch so this PR contains only the v0.9.1 release delta.