Add explicit microphone permissions for web Bench Packs

[AustinKelsay]

What changed

• let web Bench Packs declare microphone access explicitly
• grant media permission only to the active trusted loopback pack origin
• project microphone delegation into hosted pack documents
• add macOS audio-input entitlements to the app and helper bundles
• add focused permission-policy and packaging tests
• carry the integration forward onto BenchLocal v0.4.0 and refresh bounded runtime dependencies

Why

Audio Bench Packs such as realtime voice evaluations need microphone capture, but Electron's default permission behavior does not give a pack-scoped, auditable boundary. This adds an explicit manifest capability and constrains permission to the trusted active pack origin.

Validation

• 5 focused web-pack microphone tests
• all workspace TypeScript checks
• UI contract check
• macOS directory build
• deep signature and audio-input entitlement verification