feat(app): record an app's platform and refuse a release that doesn't match

[ciehanski]

dpctl had no idea what kind of app it was releasing to, so it would happily build an Android bundle and ship it to an iOS app. The server can't catch that either.

• dpctl app add --platform ios|android|expo-cng-ios|expo-cng-android records the app type at creation. It can't be changed afterward.
• dpctl app ls gains a Platform column. Apps created before platforms existed read "React Native".
• release-react now fetches the app's platform first and refuses a bundle built for the other OS, naming the command to run instead.
• Now also refuses an Expo CNG app released from a project with no Expo, which is almost always the wrong folder. The reverse only warns: a bare app that later moved to CNG still has to be able to release, since its platform is fixed.

New ota-runtime.ts holds the platform labels and both guards. detectCodePushProjectKind keys off the config plugin in app.json, not the expo dependency since bare apps commonly use Expo modules, so the package alone proves nothing.

addApp now resolves with the app the server created rather than the object it posted, so generated fields survive.