Revert onboarding to two windows; bump CLI to v0.11.0-alpha.2

[rlnorthcutt]

Summary

• Revert onboarding from a single-window React screen-swap back to the
  original two-window design (isolated "onboarding" window + "main"
  dashboard). The EGL_BAD_PARAMETER crash that originally motivated going
  single-window was never actually about window count — root-caused to CI
  building the Linux AppImage on bare ubuntu-24.04 instead of a container
  matching this repo's own Fedora dev toolbox (already fixed separately in
  release.yml). With that confirmed, two windows are safe again and
  restore the real capability-isolation boundary a single window can't
  provide — see AGENT.md's "EGL_BAD_PARAMETER AppImage crash" section and
  the plan doc's "Re-reversal" entry for the full history.
• Layer in the sibling repo's more mature setup UX where it fits this
  repo's multi-instance model: a URL-origin check alongside the existing
  window-label check, CLI contract 3's new substage/status/
  "permission"-state runtime ensure fields (truthful "Waiting for
  approval" copy instead of a synthesized percentage, per the newly ported
  tests/setup-ux-principles.md), and 4 new CLI error codes.
• Bump the bundled CLI sidecar from v0.10.0 to v0.11.0-alpha.2
  (jsonContract 2 → 3). vendor-manifest.json regenerated against the
  real release — downloaded, checksums verified against the CLI repo's own
  published SHA256SUMS, every binary re-extracted and re-hashed directly.
• Port tests/host-adapter.test.mjs (runs the real onboarding
  host-adapter.js in Node's vm module against a fake Tauri bridge) —
  which caught a real bug while porting it: a rejected automatic
  bootstrap() call had no error reporting at all, leaving the window
  stuck on neutral "Starting Omnideck…" copy forever. Fixed in
  host-adapter.js.
• tests/policy.test.mjs reworked back to two-window isolation assertions
  plus the new origin-check/contract-3 coverage.

Deliberately not ported from the sibling: its parity.rs-style
per-instance reconciliation logic (no analog in this repo's multi-instance
model) and its VM-based e2e/golden-checkpoint test infrastructure
(disproportionate to this repo's current scale, consistent with
TESTING.md's existing stance on the promotion ladder).

Test plan

• cargo build/test/clippy -- -D warnings/fmt --check clean (26 tests)
• npm run test:policy clean (30 tests, incl. new host-adapter.test.mjs)
• npm run typecheck clean
• npm run fetch:sidecars / verify:sidecars against the real
  v0.11.0-alpha.2 release
• Real npm run dev:app launch, including forcing the onboarding
  window open via OMNIDECK_DEBUG_ONBOARDING_STAGE
• Real AppImage build via the same Fedora-container path CI now uses;
  launched cleanly with the dashboard polling real container state