feat(runtime): always pull latest versions for app tiles

[galdawave]

Summary

Switch managed app runtimes from fixed/pinned versions to a latest-first strategy so IDX0 always pulls current upstream versions when starting app tiles.

Details

• T3Code and Excalidraw now:
  • fetch upstream on startup
  • resolve latest source revision (origin/HEAD with fallbacks)
  • reuse cached build artifacts only when they match the resolved latest commit
  • rebuild when source has changed
• Build records were migrated from pinnedCommit matching to sourceCommit matching, with backward-compatible decoding.
• Manifest defaults for git-backed apps were updated to "HEAD".
• VSCode now resolves the latest code-server GitHub release dynamically at runtime, with bundled manifest fallback.
• VSCode provisioning now accepts empty checksum metadata (when unavailable from latest-resolution path) while still validating checksum when provided.
• Runtime docs were updated to describe latest-tracking behavior.
• Runtime tests were updated to reflect latest-resolution + commit-aware cache reuse behavior.

Related Issues

None.

How to Validate

1. Run runtime tests:
   • xcodebuild test -project idx0.xcodeproj -scheme idx0 -destination 'platform=macOS' -only-testing:idx0Tests/T3CodeRuntimeTests -only-testing:idx0Tests/ExcalidrawRuntimeTests -only-testing:idx0Tests/VSCodeRuntimeTests
2. Start app tiles in IDX0 and verify startup logs show upstream fetch/revision resolution for T3/Excalidraw and latest-release resolution for VSCode.
3. Restart each tile and verify cache reuse occurs when upstream has not changed.

Pre-Merge Checklist

• lint-docs check is green
• tests check is green
• maintainability result reviewed (phase 1 report-only)
• Added/updated tests (if needed)
• Updated relevant documentation and README (if needed)
• Noted breaking changes (if any)
• Tested on macOS