fix: bind artifact audit to the packaged update target

[John-Ryan21337]

Closes #79.

Desktop builds already select their GitHub update repository from the build configuration, including GITHUB_REPOSITORY in fork CI. The packaged-artifact audit currently accepts only cafeai/cafe-code, so a valid fork installer can fail its runtime self-test.

Bind the resolved publish target into the packaged manifest and validate update metadata against that exact target. Missing legacy metadata keeps the official Cafe fallback. Runtime environment variables cannot change the packaged identity. The parser rejects duplicate keys, nested values, endpoint overrides, invalid identities, and oversized metadata; it accepts the scalar quoting and cache/channel fields produced by the current builder.

This changes only the manifest producer, audit consumer, and their tests. Provider versions, bootstrap, installer targets, signing, and release selection are unchanged.

Validation:

• Deterministic regression: valid fork metadata fails against unchanged current dev, then passes with this fix.
• Producer matrix covers official, fork, and explicit targets on macOS, Linux, and Windows. Consumer tests inspect synthetic packaged resources and a hostile runtime environment: 23 focused tests pass.
• Independent source review passed.
• yarn fmt, yarn lint, and full yarn typecheck pass. Full yarn test --concurrency=2 --summarize passes all 10 workspaces: 4,041 tests passed and five existing skips.
• Final yarn build:desktop --force passes all three tasks. Fresh server, renderer, and desktop artifacts are present, and the desktop bundle contains the packaged update-target validation.

The resource tests use synthetic package files. This lane does not claim a new signed installer or a physical install on every platform.