Release candidate: refinement PRD

[angerman]

Release candidate scope

This PR cleans up the 19 local commits on top of github/master into a 12-commit release-candidate stack for the timui.h refinement PRD.

Highlights:

• hardens adversarial core/widget/app/ConPTY paths
• adds checked config initialization and explicit lifecycle/message result APIs
• adds capability diagnostics and documented compatibility/Unicode/image contracts
• adds release artifacts, checksums, make fuzz, and a release runbook
• refreshes the downloadable website header

Local verification

Passed locally after history cleanup:

• nix develop -c make check
• nix develop -c make fuzz
• nix develop -c make release-check

Earlier on the same final tree before cleanup also passed:

• nix develop -c make build
• nix develop -c make test (381 tests)
• nix develop -c make www
• nix develop -c make vt-test (389 tests)
• nix develop -c make test-san SAN=undefined

Local Darwin sanitizer caveat:

• SAN=address hung in the local Darwin sanitizer runtime and was interrupted.
• SAN=thread crashed in the local Darwin sanitizer runtime before test results.
• Linux CI is expected to prove ASAN/UBSAN/TSAN for the release candidate.

Release note

Do not tag from this branch until PR CI is green and this is fast-forwarded into master.