feat: prepare Command Center v1 desktop release

[awtprod]

Summary

• replace the Alpha desktop identity with Command Center (com.awtprod.commandcenter, commandcenter://, and command-center on Linux)
• publish the canonical CLI as @awtprod/command-center with command-center plus a temporary t3 compatibility alias
• update SSH and pinned remote runtime installation to resolve the scoped package
• add explicit validate and publish release modes, fail-closed stable signing, consolidated validation artifacts, updater path validation, and SHA-256 checksums
• deploy stable hosted web releases to the dedicated Vercel production project while leaving nightlies on generated preview URLs
• update Clerk/AASA, updater, packaging, release, and remote-access documentation

Verification

• main CI at 775dfa19c is green
• 189 focused identity, packaging, SSH, versioning, updater-asset, and branding tests pass
• affected contracts, shared, SSH, server, desktop, web, and scripts typechecks pass
• focused server suite passes (106 tests)
• production web/backend/Electron build passes
• release smoke and public repository boundary checks pass
• npm publish dry-run prepares @awtprod/command-center@1.0.0
• isolated app startup succeeds with a disposable Command Center profile, and no dev process remains afterward

External release gates

Do not run stable validation until these are configured:

• create @awtprod/command-center and configure npm OIDC trusted publishing
• create the awtprod-command-center Vercel project and production deployment
• populate the production GitHub environment with relay and Clerk public configuration
• add the release GitHub App, Apple signing/notarization/provisioning/associated-domain, Azure Trusted Signing, and Vercel credentials
• update Clerk Native API redirect allowlists and AASA for com.awtprod.commandcenter

After those gates are complete, run Release with mode=validate, channel=stable, and version=1.0.0; complete the clean-profile OS acceptance matrix before running mode=publish.

The README Alpha/public-release notice intentionally remains until signed validation passes.