feat: add Hub Apps navigation and enforce PR-only main integration

[Undertone0809]

Require every change to reach main through a pull request, including release preparation and the post-release version bump. Update contributor and maintainer instructions to remove direct-push exceptions, and replace the next-version push with an idempotent maintenance branch and PR.

Maintenance PRs dispatch qualification on their own branch so the required check attaches to the PR commit. An inline bootstrap validates the immutable source and trusted workflow/guard before candidate code runs. Release promotion remains limited to qualified main sources. A handoff PR remains explicitly pending until it merges.

The live main-pr-only GitHub ruleset is active for refs/heads/main: no bypass actors, required PR, strict GitHub Actions Qualification summary, no force pushes or deletion. Effective branch rules were independently read back; current administrator bypass is never.

Validation:

• Workflow contracts: 23 passed; dispatch/bootstrap: 4 passed; CI contracts: 3 passed; actionlint and diff check passed.
• Next-version tests: 9 passed. The complete two-run idempotency case passed all 17 original assertions in a standalone local harness with byte-identical implementation. Its standard Vitest run timed out under local load; the repository timeout remains unchanged.
• No release, deployment, or real post-release PR dispatch was executed.
• Full local baseline is not green: unrelated import-order violations and database migration timeouts; full typecheck/build were not completed. Existing base 634aab5bb CI also fails the architecture ratchet and the log-store cancellation test. These checks remain enforced.

Hub Apps

Replace the Hub Showcase tab with an Apps catalog. Opening an App adds an organization-scoped primary-rail entry; its close button appears on hover or keyboard focus. Closing removes the entry and matching saved-view pins while preserving the App, saved views, data, and running processes. The catalog can reopen closed Apps.

Validation: 44 focused unit tests, the real-API Hub Apps E2E, the existing App Builder multiple-tab E2E, UI typecheck, production frontend build, and scoped diff checks passed. Independent rendered acceptance returned PASS and final review accepted the source. Web UI validation covers dark/light themes, constrained layout, active/inactive close, refresh, organization isolation, and saved-view alias cleanup. No new Desktop installer was packaged, and no release or deployment was performed.