feat: integrate and harden Franklin Desktop

[KillerQueen-Z]

Summary

• integrate the stable Franklin Desktop app under apps/desktop as an npm workspace
• bundle the reviewed Franklin runtime into the packaged app and add unsigned macOS/Windows CI artifacts
• secure the loopback agent with per-launch credentials, signed media URLs, origin/navigation/IPC checks, CSP, minimal child environment, and cloud history sync disabled by default
• add Desktop permission prompts for shell commands and local files outside the active workspace, including media and browser file paths
• keep Team Mode out of this stable integration

Validation

• npm test: 652/652 passing
• Desktop typecheck, lint, build, Electron syntax checks, and git diff checks passing
• focused serve security tests: 5/5 passing
• macOS arm64 DMG built successfully (224 MB, unsigned test build)
• packaged app launched successfully with the bundled agent online on a random loopback port

Security notes

• no wallet private key is serialized to the model gateway; prompts, selected conversation context, approved tool inputs/results, and payment authorization metadata still leave the machine as required for model execution
• packaged Desktop uses local-only history by default
• npm audit still reports transitive upstream advisories in Polymarket/Solana/Ethers packages for which no non-breaking upstream fix is currently available; forced overrides were intentionally avoided

Release status

This PR adds test packaging only. Public release still requires signing/notarization and the separate release/download pipeline.