fix(desktop): retain skills and reuse release artifacts

[FerroxLabs]

Related: #1347.

Intel DMG packaging exhausted the destination image, omitted Electron Framework and retried the same failed copy three times. The workflow now budgets filesystem overhead, verifies copy integrity and saves the signed/notarized app ZIP before DMG work. A failed packaging job can reuse that verified checkpoint from the same producer and exact source without rebuilding or notarizing the app again.

Checkpoint admission verifies the GitHub artifact digest before extraction and binds repository, run, source, architecture, version, signing identity and content hashes. ZIP bytes and updater metadata are preserved. Failed-job retry instructions replace the producer's broken self-rerun; draft uploads skip identical assets and refuse replacement bytes. Existing protected installer, updater, final acceptance and publication gates remain required.

The pending masterclass candidate bundles TVControl 2.5.3 with its exact integrity pin, managed upgrades and 113-tool fixture. An early native Core MCP probe detects the Windows spaced-executable launcher failure before packaging.

Imported skills previously disappeared from the picker after restart because registration was memory-only, while their installed directories still caused duplicate-import rejection. Completed imports now persist in app-owned configuration, with input hashes, consent evidence and fresh guard checks at startup. Identical legacy reimports use the existing consent flow without overwriting files; different content remains refused. Import-provider failures now return typed errors so the dialog displays the failure and clears its loading state.

Validation:

• Publishing/TVControl focused checks: 121 passes, three Windows-only skips; signed historical checkpoint save/restore/finalize preserved app and ZIP hashes. No-build Intel image copy and deep signature verification passed; its diagnostic DMG is not release-admitted.
• Import correction: nine durability/consent tests, 35 importer checks, 26 unchanged library checks and nine provider/dialog checks pass. Typecheck, formatting and lint pass (existing sequential-await warnings retained).
• Mac and Windows native original-ZIP consent/import and restart persistence pass, preserving original ZIP and installed bytes. Mac also passes explicit TIDE selection, the guided 74/74 chart-only report, HTML/Artifacts opening, chart restoration and terminal checks; guided inputs were required.
• Authenticated Core candidate 131678fa with TVControl 2.5.3 passes native Windows MCP initialization with 113 tools and clean child-process shutdown. This is development evidence, not final release admission.

Keep draft and unmerged: official Core bundle pins remain 0.13.12 pending the publisher's corrected release. Matching development Core contract import is isolated outside this branch; final published binaries/features/manifest still require normal admission. The full Windows report remains unaccepted, Core provider qualification is outstanding, and development-app Mac normal quit needs disposition. Same-producer CI retry, immutable live upload and final signed installer/update gates remain unproven. This PR has not published a Desktop release.