fix(packages): reject impossible manifest timestamps

[rwang23]

Summary / 摘要

• Validate RFC 3339 calendar fields for manifest.createdAt before accepting a theme package.
• Keep the runtime and both generated platform validator copies synchronized.

Type / 类型

• Bug fix / 缺陷修复
• Feature / 新功能
• Docs / 文档
• Theme / CSS / visual / 主题或视觉
• Scripts / install / restore / 脚本或安装恢复
• Chore / 杂项

Platform / 平台

• macOS
• Windows
• Both / 双平台
• Docs / repo only / 仅文档或仓库元数据

Self-check / 自测

macOS (when code under macos/ changes)

• macos/tests/run-tests.sh passed / 已通过
• Doctor (optional): macos/scripts/doctor-macos.sh
• Live verify (if inject/CSS/start path): verify-dream-skin-macos.sh or Desktop Verify

Windows (when code under windows/ changes)

• Relevant install / start / verify / restore scripts exercised / 已按改动跑过对应脚本
• Environment noted below / 下方注明环境

User-facing / 用户可见变更

• Updated macos/CHANGELOG.md (and macos/VERSION if release-worthy) / 已更新 changelog（发版时再 bump VERSION）
• N/A — no user-facing change / 无用户可见变更

Security / 安全

• Does not modify official Codex install / asar / signatures / 未修改官方安装与签名
• Does not silently write API Base URL or keys / 未静默写入 API Base URL 或 Key
• CDP remains loopback-oriented (127.0.0.1) where applicable / CDP 仍仅本机回环（如适用）

Notes / 补充

A shape regex plus Date.parse() can accept a normalized impossible date such
as 2026-02-30. The patch checks leap years, days per month, clock ranges, and
offset ranges before retaining Date.parse() as a final parseability check.

Validated on Windows at main@611c101 with:

• node --check for runtime, macOS, and Windows validators — passed
• node tools/sync-runtime-assets.mjs --check — passed
• node --test macos/tests/theme-package-validator.test.mjs — passed
• powershell.exe -NoProfile -ExecutionPolicy RemoteSigned -File windows/tests/run-tests.ps1 — passed
• git diff --check — passed

macOS-native importer integration and Desktop smoke tests remain CI/device
gates.

Tracking issue / 追踪 Issue

Closes #297