feat: secure managed local runtime boundary

[tuzuminami]

Summary

• route packaged WebUI calls through a Rust-owned authenticated localhost proxy, with native confirmation for deletion and proof-checked sidecar ownership
• replace typed filesystem paths with Finder-scoped imports and native export destinations; redact legacy path history and clear transient scopes after deletion
• bound 100k-event IPC/UI behavior, add localhost import/export performance smoke coverage, and keep normal API operations at a 3-second timeout while scoped file transfers have a bounded 20-second window

Closes #75
Closes #77
Closes #58

Verification

• ./scripts/test.sh
• ./scripts/lint.sh
• ./scripts/check_licenses.sh
• ./scripts/check_no_external_network.sh
• ./scripts/perf_smoke.sh
• cargo test --locked --manifest-path apps/desktop/src-tauri/Cargo.toml

Review

• oss-reviewer: no P0/P1 findings after final review; packaged WebView layout/paint is intentionally retained for [P0][Quality] packaged .appのclean Mac E2Eとv1 release acceptanceを強制する #85 clean-Mac E2E coverage.