refactor(desktop): lock renderer root architecture

[chihumyum]

Summary

• Add enforced Desktop renderer ownership zones and a generated AppShell/root debt baseline.
• Prevent AppShell and root-entry dependency growth while allowing debt to shrink during later slices.
• Pin the production renderer entry chain from the main process through Vite to main.tsx.
• Run the architecture check in CI.

Refs #3439

This is the R1 root foundation. It does not move feature ownership out of AppShell or close #3439.

Verification

• npm run check:renderer-architecture -- --base upstream/main
• TMPDIR=/private/tmp npm test
• npm run build
• npm run typecheck
• npm run lint
• npm run format:check

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex — implementation and validation.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — CI and builds now reject renderer architecture regressions; runtime product behavior is unchanged.
• No