fix(packaging): harden native extension validation

[XingYu-Zhong]

Summary

Follow-up to merged PR #865. It fixes the Windows thread-store path check and makes Linux AppImage validation exercise the sandboxed product entrypoint instead of a test-injected flag.

Changes

• use platform-aware path containment for Kun thread and session storage on Windows
• package a fixed Linux launcher that preserves Chromium user-namespace and seccomp sandboxing while keeping ELECTRON_RUN_AS_NODE commands unchanged
• validate the exact AppImage launcher, ELF payload, resources, desktop entry, and direct final-AppImage Chromium flow
• make PR, stable, and daily Linux jobs verify user namespaces before desktop smokes
• document Linux userns requirements, diagnostics, release evidence, and future relaunch/package constraints
• add a type-only annotation for a new develop-branch test fixture so the existing Kun typecheck can run
• record completed native package evidence in OpenSpec; protected signed/notarized release sign-off remains pending

Tests

• npm run check:extension-release-gate
• npm run lint
• npm run typecheck
• npm --prefix kun run typecheck
• targeted Kun tests: 3 files, 14 tests
• launcher/AppImage/desktop tests: 40 tests
• npm run check:extension-docs
• npx openspec validate build-kun-extension-platform --strict
• git diff --check

Native validation

Final head 114f4694b6b4abae8d4c7f8bac44486ce28c2431 was tested through synthetic merge d38090403ad4e5c7a8e50ca68c6acce18fba74b7 in PR Checks run 29181030464. Typecheck/tests and all native package jobs passed, including Windows backend/Chromium, Linux userns plus direct final-AppImage Chromium, and macOS x64/arm64 backend plus host-native Chromium.

• Linux AppImage artifact 8256497108 — 276,737,885-byte archive
• Windows NSIS artifact 8256521252 — 241,190,791-byte archive
• macOS ad-hoc artifacts 8256550272 — 1,095,404,151-byte archive
• CodeQL run 29181029629 — Actions and JavaScript/TypeScript analyses passed

The earlier commit-bound run 29180466710 was independently downloaded and hash-checked; exact package bytes and SHA-256 values are recorded in the OpenSpec task evidence. This PR intentionally remains draft and does not publish a release.

[XingYu-Zhong]

This PR unblocks the develop → master release PR #866. The current #866 failure is the Kun runtime typecheck error in skill-tool-provider.test.ts; this branch includes the typed ToolHostContext fix and has passed Typecheck and test, CodeQL, and native Linux/Windows/macOS packaged validation. Please review when available.

[github-actions]

PR checks failed. Please fix the failing CI jobs before merging.

Failed jobs:

• Build Linux package

Run details: https://github.com/KunAgent/Kun/actions/runs/29181697794