feat: complete Forkara runtime identity break

[redxzeta]

Summary

• replace active runtime, desktop, CLI, protocol, storage, artifact, and release identities with Forkara
• add a copy-only, staged-and-verified first-launch import from the legacy local profile, with active/WAL/recovery refusal and idempotent completion markers
• enforce the narrow predecessor boundary with an allowlist-based identity scan and document manual first installation

Closes #189

Validation

• node scripts/check-brand-identity.ts
• git diff --check
• focused migration, desktop identity/profile, release-artifact, identity-guard, and server adapter tests passed before the requested local-test stop
• bun fmt and bun lint passed (lint reported existing warnings)
• full bun run test was not completed locally: the web build was killed by the local memory limit; no additional local rerun was requested

Delivery boundary

• no release, publication, updater activation, GitHub secret/variable change, or merge is included
• predecessor users install the first Forkara build manually; compatibility is limited to the one-time local-data import