fix(configurator): harden confirmations and release publication

[devmobasa]

Summary

Hardens the GTK4 configurator’s destructive confirmation flows and makes AUR publication fail safely before modifying or publishing release channels.

These fixes are feature-independent and do not include the proposed adw-modern UI.

What changed

Configurator safety

• Split Defaults reset into explicit Request, Confirm, and Cancel messages.
• Prevent repeated requests or stale confirmations from replacing newer edits.
• Make Session Clear Confirm and Cancel carry the session identity.
• Prevent stale cancellation from disarming a newer session’s confirmation.
• Track confirmation status by typed origin instead of rendered English text.
• Preserve newer errors and status feedback when a confirmation closes.
• Move keyboard focus to newly revealed confirmation controls.

Packaging and release safety

• Declare the existing libadwaita 1.4 runtime floor in Debian, RPM, and Arch metadata.
• Update the standalone configurator AUR metadata from Iced to GTK4/libadwaita.
• Require the configurator AUR channel unless --no-configurator is passed explicitly.
• Validate release versions as MAJOR.MINOR.PATCH[.HOTFIX].
• Require exactly one matching artifact with a 64-character hexadecimal checksum.
• Reject failed and successful-but-empty source downloads.
• Require selected AUR paths to be usable Git worktree roots.
• Transform and validate every selected recipe in isolated temporary worktrees before touching real checkouts.
• Prepare every selected channel before pushing them sequentially.
• Add offline regressions proving invalid or late failures do not modify, commit, or push earlier checkouts.

Compatibility

• The configurator continues targeting the libadwaita 1.4 API.
• Ubuntu 24.04 remains supported.
• No adw-modern Cargo feature is introduced.
• No libadwaita 1.7+ controls, conditional UI branches, Nix feature routing, or Arch-modern CI are included