feat(plugins): add client runtime and typed UI slots

[xxhZs]

Summary

• add an optional Client entry to maka.extension.json and carry Client-only or Host+Client packages through the existing package store, immutable generations, composition, restart recovery, and rollback model
• project active desktop-ui bundles through a strict Runtime Host protocol, then serve content-addressed JavaScript to the Renderer through a scoped Desktop transport
• add a typed Client Runtime with staged activation, atomic graph swap, reverse cleanup, dependency-generation refresh, and last-good-UI preservation on failure
• add recursive single, list, keyed, and chain Slots with root, optional-Session, and strict-Session scopes
• mount native Slots for shell overlays, sidebar footer, Settings navigation/pages, conversation header/turn footer/composer toolbar, and keyed Tool details
• expose a compatibility-governed @maka/ui/client-plugin SDK with an explicit Astryx primitive allowlist rather than the private product barrel

Scope

This combines the planned Client Runtime and typed UI Slots work in one PR. Host↔Client RPC, streams, product events, plugin management UI, SDK build tooling, and untrusted Renderer sandboxing remain follow-up work.

Testing

• NODE_NO_WARNINGS=1 npm test
• npm run build
• npm --workspace @maka/ui run test:dist (473 tests)
• npm --workspace @maka/ui run typecheck
• npm --workspace @maka/desktop run typecheck
• npm run check:renderer-architecture (112 tests)
• npm run astryx:surface-inventory && npm run astryx:surface-inventory:test (19 tests)
• npx knip --workspace packages/ui
• npm run lint
• npm run format:check
• npm run check:asf-headers
• git diff --check