fix: harden DCP patching and release reliability

[ClausValcaTD]

Summary

This PR hardens DCP patching and makes release/CI behavior more reproducible without changing supported ROM formats or public CLI behavior.

Changes

• Reject DCP output directories inside the source disc directory.
• Apply DCP patches in a staging directory and commit files only after successful decoding/patching.
• Clean up staging directories on copy or patch failures.
• Preserve nested paths for xdelta/ entries instead of flattening them to basenames.
• Add regression coverage for unsafe DCP output paths.
• Add a real GitHub Actions quality gate for PRs and pushes to main:
  • Dart/Flutter formatting
  • Dart/Flutter analysis
  • Dart/Flutter tests
  • version consistency
• Align VERSION, core, and GUI versions with 3.7.0.
• Correct the README DAT parser claim to avoid claiming full streaming support.
• Pin OpenROM-bins to commit 586f7cc54df0facf9df9d3066c70e6b434b93753 across Windows, Linux, ARM64, macOS, and Flatpak release jobs.

Validation

• git diff --check passed.
• Version consistency checks passed.
• Dart/Flutter tests could not be run locally because the sandbox does not have Dart or Flutter installed; the new quality workflow will run them on GitHub.