test(product): validate packaged Standard Code product slice

[Qiyuanqiii]

Summary

• add an independent fail-closed standard_code_product_e2e.v1 producer for the exact portable ZIP/EXE, frozen four-language oracle, and candidate-owned SQLite/Drydock state
• require real fail → diagnose/retry → pass Command Runtime Jobs, reviewed edits, current Diff/Artifact/Checkpoint/receipt facts, exact Undo/Rewind/Fork links, and aligned Desktop/CLI/HTTP/Handoff/final projections
• bind zero-argument launch, Local/Docker readiness or pending risk-escalation Approval, Thread continuity, edge preservation, and the Windows 10/11 × 100%/200% UX matrix to unique SHA-256 evidence
• add a three-phase Windows operator script (Prepare, InjectConcurrentEdit, Collect) plus the product evidence runbook documentation

Truth and integration boundaries

• the collector reads durable product records after the exact candidate exits; Agent prose, fake runners, skips, waivers, stale receipts, host execution, Full Access, and Debug cannot produce pass
• an unavailable backend remains workspace_access and must expose a pending host_command_propose/risk_escalation/per_call Approval; it is never silently upgraded or counted as a passing workflow
• the independent producer does not edit .github/workflows/release-desktop.yml, scripts/standard-code-packaged-e2e.ps1, the aggregate report, or the final test(release): Standard Code Beta 工程门、packaged smoke 与安全矩阵 #140 gate

Validation

• go test -count=1 ./cmd/producte2e ./internal/producte2e ./internal/packagede2e ./internal/standardcodedelivery ./internal/desktop ./internal/httpapi
• go test -race -count=1 ./internal/producte2e ./internal/packagede2e
• go vet ./...
• go mod tidy -diff
• go run ./cmd/protocolregistry -check -baseline 76428e25a78d23ea22924618cd2630399e980598
• go run ./cmd/surfacecheck
• npm run check:api
• npm test -- --run (73 files / 351 tests)
• npm run typecheck
• npm run build
• PowerShell AST parse of scripts/standard-code-product-e2e.ps1
• real cmd/packagede2e --verify-toolchains oracle run for Go, Node.js, Python, and Rust
• go test -timeout 30m -count=1 ./internal/store

Base SHA: 76428e25a78d23ea22924618cd2630399e980598
Head SHA: 113c4e50a62a1ccf5652ac2b9364342a4c64c4b3

Closes #182
Refs #140