Add native macOS Desktop and Agent setup prompts

[askac]

Why

Desktop has Windows/WSL launchers, while native macOS setup and the Agent first-use workflow remain outside the public implementation. Operators need a platform-native launch path and exact-instance guidance to use the bundled Core skills and helpers.

What changed

• Add native macOS Python discovery, architecture checks, private runtimes, login shells and arm64 DMG staging.
• Add an opt-in Agent menu and tokenless skill/helper discovery, with required public-document checks during packaging.
• Preserve Windows/WSL launchers, profiles, installer cleanup boundaries and per-copy human approval; reject incompatible modes/interpreters instead of silently switching platforms.
• Keep Desktop at 0.4.3 / Core 2.11.0-dev for evaluation; macOS remains ad-hoc signed and not notarized, with manual installer acceptance still pending.

Testing

• Cover all 63 Desktop unit cases on Windows, plus WSL unit coverage and the complete Core headless suite.
• Verify bootstrap/runtime ownership, cancellation, authentication, exact-instance discovery and port-conflict behavior with isolated Windows/WSL fixtures.
• Exercise source Electron on WSLg, native Windows and Windows with WSL: Agent prompts, shells, reload, sandbox/navigation, PiP, PNG and decodable silent WebM; Files works on WSL and remains unavailable for native Windows Local Shell.
• Verify all 108 macOS delivery build-input hashes and the identical 72-file Core manifest in a new Windows input stage. Native macOS execution evidence belongs to the producer's candidate tests; no new Mac hardware or installed-app acceptance is claimed here.
• Rebuild the unsigned Windows x64 NSIS candidate from this source. Verify both the pre-smoke unpacked app and final NSIS-extracted payload; packaged Windows and Windows-with-WSL capture smoke pass. Setup was not executed over an existing installation.

The first Windows integration test run exposed a hardcoded POSIX path expectation in a Mac unit test. Correcting the host-dependent test expectation and rerunning the full suite passed without changing packaged runtime code. Build/package validation and unsigned evaluation limitations are separate from production signing and installer lifecycle acceptance.