feat(lab): add deterministic regression profiles

[lefoulkrod]

What changed

• add explicit product-ready and onboarding-clean regression profiles
• script and certify browser-ready golden images with exact disposable credentials
• make routine preflight metadata-only while retaining deep certification for image maintenance
• stage candidates as one compressed, SHA-verified bundle
• make leases, interruption cleanup, and native macOS permission verification deterministic

How it was tested

• bash tests/lab_test.sh
• node --test tests/*.test.mjs
• Desktop product and onboarding regression across AppImage, DEB, RPM, Atomic, and Windows
• CLI product and onboarding regression across AppImage, DEB, RPM, and Windows
• native macOS ARM64 aggregate CLI/Desktop regression
• all VM lanes restored to stopped state; macOS host returned ready

Release note

release-notes.d/deterministic-regression-profiles.md