release: prepare v0.3.3 beta

[rwang23]

Release candidate: v0.3.3 Beta

Prepares the exact release metadata and tag workflow for a v0.3.3 GitHub prerelease Beta. This PR does not create a tag, a GitHub Release, or a deployment.

Included

• Bumps the root package, Theme Manager package/lockfile, Tauri, and Cargo versions to 0.3.3 from the authoritative release metadata.
• Synchronizes the tag guard, release title, generated release metadata, and changelog.
• Adds bilingual release notes with the current Beta trust and verification boundaries.
• Makes the generated draft Release body explicit that the v3 runtime remains source-tested, exact-app recapture is pending, and the updater feed is still unreleased.

Validation

• npm run check
• npm run a11y:check --prefix apps/theme-manager
• npm run runtime:benchmark
• npm run installer:validate
• npm run desktop:build:win (local NSIS package reports version 0.3.3)
• npm run metadata:check
• C:\Users\desre\.codex\tools\workflow-lint.ps1 -Root <repo>

After merge, with separate release authority

1. Push the v0.3.3 tag.
2. Let the tag workflow create a draft GitHub prerelease.
3. Read back the signed Windows/macOS assets, .sig files, names, architectures, hashes, warnings, and the final isPrerelease=true state before publishing.
4. Keep the in-app updater feed unreleased and do not claim physical-app Full Skin v3 or physical-macOS verification.

#13 tracks the action-after GitHub release-state verification.