feat: add cross-platform agent HAP signing

[guantw]

Summary

• add an agent-oriented HAP inspect, debug-sign, and optional install workflow for Windows, Linux, and macOS
• add Linux toolchain discovery, locked portable-toolchain preparation, packaging support, and platform-independent HDC handling
• use a configurable isolated Edge/Chrome authorization context by default and expose machine-readable diagnostics, paths, capability fallback, and migration warnings
• protect signed outputs with explicit overwrite policy and atomic publishing while allowing sign-only cache reuse or a trusted device UDID
• add repository-scoped signing guidance, migration documentation, release checks, and synchronized HapSign skills

Breaking changes and migration

doctor --json exposes the complete catalog and inspect --json reports changes applicable to a HAP. docs/MIGRATIONS.md contains the configuration and migration commands.

• HAPSIGN-BREAKING-001: incompatible legacy signing caches are no longer reused; match the capability mode, explicitly run migrate-cache --profile-type normal|system-basic when safe, or back up and refresh
• HAPSIGN-BREAKING-002: the CLI browser default changes from system to system_controlled; restore the old behavior with --browser system or HAPSIGN_BROWSER=system
• HAPSIGN-BREAKING-003: default CLI state and output locations move to application-configured directories; restore previous paths with CLI flags or the dedicated environment variables
• HAPSIGN-BREAKING-004: stdout results remain separated from stderr diagnostics; automation should consume --json
• HAPSIGN-BREAKING-005: the explicit subcommand interface remains; flat CLI invocations must migrate to doctor, inspect, migrate-cache, auth, devices, sign, deploy, or install

The cache migration is local-only, creates a backup, normalizes material paths, and rejects stale, incomplete, conflicting, wrong-bundle, or invalid-device metadata.

Validation

• 266 tests passed with 2 expected platform/dependency skips
• coverage reported at 78%; no coverage threshold gate
• repository-wide Ruff check, format check, compileall, and whitespace checks passed
• wheel build passed
• repository signing/deploy skills and the installed signing skill passed validation; repository and installed signing copies have identical hashes
• read-only doctor and normal/system-basic inspect checks against the BitFun unsigned HAP returned the expected compatibility warning without login, migration, signing, or installation