feat: complete Go production cutover

[u2bo]

What changed

• Replace the production Node.js host/runtime with the Go implementation across Studio, Controller, and Runtime commands.
• Use the same Go production path for Windows and macOS packaging.
• Remove the retired Node production host, runtime, downloader, staging, launcher, and duplicate tests.
• Add Runtime Contract coverage and Release Manifest v2 for Node-free native packages.
• Complete list-themes, .ocskin import, exact-version selection, and explicit stopped/error behavior.
• Preserve v0.2.0 theme data and rollback compatibility.

Why

The Go cutover makes the production runtime smaller and gives Windows and macOS one source of truth, while retaining the existing Theme Studio and compatibility guarantees.

User impact

• Existing users keep their theme data and rollback path.
• Windows packages continue to provide ZIP and Setup variants.
• macOS packages use the native Go App Bundle payload.
• This PR prepares the v0.3.0-alpha.1 prerelease; it does not publish a stable release.

Verification

• npm run verify: 27 test files / 217 tests, TypeScript build/typecheck, all Go tests, and go vet passed.
• govulncheck ./...: no reachable vulnerabilities.
• Windows ZIP and Setup were built and manually accepted locally.
• Runtime and Studio smoke checks passed on Windows.
• Latest macOS App Bundle layout still requires native GitHub runner verification before merge/tagging.