Restore packaged desktop preload bridge

[WebCrew]

Outcome

Restores the Electron desktop host bridge in packaged builds, so project creation and project-backed saving are available again.

Root cause

The Beta 2 preload attempted to load package.json with a local require() before exposing window.parlynHost. Electron's sandboxed preload environment rejects that import and aborted the entire bridge.

Changes

• read app version/platform through a trusted IPC handler backed by app.getVersion()
• keep the preload limited to the supported Electron API
• add a restricted VM contract test that would fail on the Beta 2 regression
• add a real sandboxed Electron preload smoke test to every Windows package build
• prepare a non-overwriting v0.5.0-beta.3 replacement prerelease and acceptance checklist

Verification

• npm run check ✅
• renderer release bundle ✅
• real Electron smoke test is wired into both Windows build commands and will run on the Windows CI runner

Closes #25. Continues #23.