feat(apps): M3 groundwork — packager, GitHub device-flow auth, registry client

- env: GITHUB_OAUTH_CLIENT_ID (device flow enabled on the Rowboat OAuth app;
  overridable via ROWBOAT_GITHUB_CLIENT_ID)
- packager (§4.4): allowlist-only .rowboat-app ZIP (yazl), sorted entries,
  symlink skip, sha256
- github-auth (§10): device-code start/poll, identity fetch, token stored
  0600 with safeStorage encryption injected from main (core stays
  electron-free); githubAuth:* IPC + external open of the verification page
- registry client (§9.2): unauthenticated tarball index with 5-min cache and
  stale fallback, raw-record resolve, substring search, quota-free
  latestManifest via release-asset redirect with name-mismatch guard
- registry repo contents (docs/apps-registry): record JSON schema +
  validate-and-merge Action implementing §9.3 checks 1-7 with rejected:<code>
  comments and per-name concurrency
- fix: host-api copilot-run adapted to dev's ModelSelection {provider,model}
  (this is the same fix dev needs for Ramnique's packaging break)
- pnpm 11: blockExoticSubdeps=false (electron-forge has a git subdep)

apps/x/packages/shared/src/ipc.ts

@@ -1256,6 +1256,26 @@ const ipcSchemas = {
     req: z.object({ theme: z.enum(['light', 'dark']) }),
     res: z.object({ ok: z.literal(true) }),
   },
+  // GitHub auth (device flow) — required only for publishing apps (spec §10).
+  'githubAuth:start': {
+    req: z.object({}),
+    res: z.object({ userCode: z.string(), verificationUri: z.string(), expiresIn: z.number() }),
+  },
+  'githubAuth:poll': {
+    req: z.object({}),
+    res: z.object({
+      status: z.enum(['pending', 'authorized', 'expired', 'denied']),
+      login: z.string().optional(),
+    }),
+  },
+  'githubAuth:status': {
+    req: z.object({}),
+    res: z.object({ signedIn: z.boolean(), login: z.string().optional() }),
+  },
+  'githubAuth:signOut': {
+    req: z.object({}),
+    res: z.object({ ok: z.literal(true) }),
+  },
   'composio:didConnect': {
     req: z.object({
       toolkitSlug: z.string(),