fix: harden plugins, themes, sensors, and bridge boundaries (0.0.52)

[gyng]

What changed

• harden plugin package refresh/removal, CSS consent storage, source cleanup, package fetch reuse, and Windows filename validation
• make theme persistence errors visible and preserve editor state; prevent stale asynchronous theme CSS from winning
• stop expensive sensor polling after the last demand reporter disappears while retaining safe startup behavior
• allow explicitly supported remote widget images through the production CSP
• add high-value regression coverage for each failure mode and document plugin consent behavior
• prepare the lockstep Cargo/Tauri v0.0.52 release version

Why

The follow-up review found several fail-open or stale-state edges: same-ID plugin refreshes could retain removed capabilities, failed deletes could lose approvals, theme writes could report success after backend failures, asynchronous theme loads could race, and zero-window sensor demand could keep expensive polling alive.

Validation

• client type-check and lint
• 3,176 Vitest tests across 277 files with coverage thresholds passing (99.57% statements, 98.93% branches, 99.83% functions, 99.91% lines)
• production client build and generated-doc freshness check
• 34 Playwright E2E tests
• 218 Rust tests (216 passed, 2 ignored manual smoke tests)
• Windows cargo clippy -- -D warnings
• cargo fmt --check
• Windows Cargo check for widgetsack v0.0.52