Add source installer and harden MOW Cockpit workflows

[mow-coding]

Summary

• add the dependency-free source-alpha mow installer/update CLI with dry-run planning, receipts, source pinning, rollback, and strict diagnostics
• recognize the WOM v0.3.253 archive-root contract without editing WOM-owned records, indexes, identity, source mirrors, or runtime metadata
• harden MOW Cockpit with native ConPTY sessions, provider-specific prompt delivery, persistent close-and-reattach sessions, explicit shutdown, Codex structured approvals, and file-backed Harness gates
• add Windows/Linux CLI CI, Windows source and packaged Cockpit E2E, and a manual signing workflow that refuses unsigned output
• refresh the public README, Cockpit guide, changelog, revalidation report, and draft v0.2.0-alpha.2 source prerelease notes

Real workflow evidence

• locally authenticated Codex gpt-5.5 with xhigh reasoning and Claude claude-opus-4-8; no mock providers for extended dogfood
• two complete Phase 0 through Step 5 cycles with 20 valid artifacts
• the exact late-clerk OFF failure was reproduced and closed by one bounded clerk-only deactivation recheck
• source and packaged failure recovery stopped on paired HOLD evidence, returned to Phase 0, and resumed through Step 1
• a fresh unpacked package preserved both provider PIDs and the authenticated supervisor PID across full app close/reopen, replayed terminal output, delivered a shared prompt after reattachment, and left zero child processes after explicit shutdown
• single-target routing, multiline history, direct terminal input, BRAKE, restart, scrollback, compact layout, project switching, and close-during-turn cleanup passed in isolated real-TUI dogfood

Automated verification

• root CLI: 36 passed on Linux and Windows with Node 20 and 22
• npm package candidate: inspected successfully; no publish
• Cockpit unit: 76 passed
• real child-process integration: 2 passed
• development Electron E2E: 8 passed
• packaged Electron E2E: 8 passed
• Node 22.13.1 multiline regression: 2 focused E2E passed
• detached supervisor close-and-reattach stress: 5 consecutive passes
• GitHub Actions run 29446905423: all five jobs passed, including Windows Node 22 source and packaged Cockpit checks
• public-safety denylist scan: passed before staging, after staging, after commit, and in the pre-push hook

Honest limits

• Claude structured approval parity is not complete; real TUI mode remains the default
• close-and-reattach persistence is currently Windows TUI-only
• no signing certificate secrets are configured, so no signed executable is claimed

Publication boundary

This PR is a source review checkpoint. It does not create or move a tag, publish an npm package, create a GitHub Release, attach an executable, or merge main. The existing v0.2.0-alpha.1 source prerelease and stable Harness v0.1.23 release remain untouched, and the repository's live collab/ room was not modified.