feat: install Core on Linux, macOS and Windows through one workflow

[SaladDay]

Core installation currently requires Linux amd64 and executes a command copied from its Linux container on the host. This change ships a native oac command for Linux, macOS and Windows while keeping configuration preparation, recovery, image pulls and Compose startup in one implementation. Shell and PowerShell only download, verify and launch it.

Docker owns persistent data and secret permissions through a named volume. Core, Web and initialization images are published for Linux amd64 and arm64; sandbox Node and hosted Runtime remain Linux amd64. Key rotation runs in the initialization container, and subsequent startup repairs its derived digest after an interrupted rotation. Installation requires Docker Engine 26+ and Compose 2.26+; macOS and Windows use Docker Desktop with Linux containers.

Installation, configuration, operation and release docs are synchronized in English and Chinese. Sign-in shows a portable Compose command to read the Core key; obsolete host paths, lock names and bundle-repair instructions are removed.

Validation:

• Native Core builds and installer tests pass on Linux amd64, macOS Intel/Apple Silicon and Windows x64. The Windows launcher passes native execution, checksum rejection and command-failure tests.
• Native Linux amd64/arm64 Compose smoke tests pass from empty data volumes, including sign-in, API requests, data preservation, key rotation and recreation.
• The sign-in browser test verifies the displayed/copied command and authentication flow. Type checking, documentation links and translation checks pass.
• Shared recovery tests include forced process termination and file-write failure. Local Go race tests, release/archive checks, launcher checks, Compose configuration, CI selection and bilingual documentation checks pass.
• Independent blind review found no substantiated blocking issues within the agreed scope.

The full repository CI suite passes on the final commit. End-to-end Docker Desktop installation and actual multiarch registry publication have not been exercised; release support is implemented but no release has been published by this PR.