feat: add signed OTA unlockers with runtime hardening

[chubbygrannychaser]

Summary

• Add an OTA unlocker system that pulls signed unlocker manifests/modules, verifies signatures and hashes, and executes hoster resolvers in a constrained worker sandbox.
• Wire OTA resolution into download flows with fallback to built-in hosters, add periodic manifest refresh, and improve GoFile handling/token generation plus HTTP downloader defaults.
• Add unlocker publish tooling/workflow and ignore local generated artifacts (unlockers/manifest.json, unlockers/manifest.sig) while keeping private keys excluded.

Verification

• yarn typecheck:node
• pre-push hooks: yarn lint --fix and npm run typecheck (node + web)

[sonarqubecloud]

Quality Gate failed

Failed conditions
2 Security Hotspots

See analysis details on SonarQube Cloud