refactor: generate cold-start routes at build time for v6.5.0 (OK-57861)

[huhuanming]

OK-57861

---

Summary

Backports the complete fix from #12496 to release/v6.5.0.

• compile the cold-start route graph at build time for Web, web-embed, Extension, Desktop, iOS, Android, and generic Native targets
• keep production and development route assets isolated
• preserve v6.4 displayed deep-link behavior and shared cross-platform route coverage
• validate sensitive onboarding and firmware-update route parameters
• retain the existing v6.5.0 Web DApp URL fallback while adopting the new resolveScreens implementation

Why

Runtime route discovery kept route modules in the cold-start dependency graph and made generated route coverage harder to audit. Some strongly typed onboarding routes could also mount with missing or malformed URL parameters.

This backport makes the route topology deterministic at build time, reduces production cold-start exposure, and fails closed for sensitive route inputs without changing established displayed URLs.

Impact

• production bundles load only the production cold-start graph
• deep-link behavior remains compatible with v6.4.0
• malformed sensitive onboarding links no longer reach page implementations
• generated artifacts are produced before builds instead of being committed

Port notes

The 16 commits from #12496 were replayed in order onto the latest release/v6.5.0. The only conflict was in packages/kit/src/routes/config/index.ts; the resolution preserves the release branch's Web DApp fallback and adds the backported resolveScreens import.

Validation

• yarn install --immutable --inline-builds
• yarn routes:generate
• yarn routes:check
• focused Jest: 9 suites, 119 tests passed
• type-aware oxlint on 50 changed JS/TS files: 0 warnings, 0 errors
• full TypeScript check with tsgo --noEmit
• git diff --check

yarn agent:check --profile commit still hits the Windows child-process spawn issue documented in #12496; its underlying route generation, lint, tests, and TypeScript checks were run directly and passed.

[originalix]

当外部 URL/hash 直接指向 TxConfirm、TxAmountInput、TxReplace 等内部步骤时，allowColdStart: true 会让 linking config 接受该路径。

这些页面依赖结构化交易对象、数组和回调，并会直接读取或解构 route.params；这些状态无法由 URL query 重建，因此会进入无效签名流程或直接崩溃。Navigator 内部能够导航到这些页面，并不要求它们成为冷启动入口。

请只为真实的外部入口保留 allowColdStart，例如 TxConfirmFromDApp、MessageConfirmFromDApp 和实际使用的 LNURL/WebLN 页面，并让内部确认、编辑和选择步骤不进入 linking manifest。

[originalix]

当非 Extension 客户端收到 /permission/web-device 时，这个无条件根路由会让 Web、Desktop 和 Native 都解析并打开 WebUSB 权限页。

该页面直接调用 navigator.usb.requestDevice()；Native 或不支持 WebUSB 的环境没有对应能力，会进入不可用页面并抛出错误。这里原本的平台条件同时也是路由安全边界。

请恢复 platformEnv.isExtension 限制，并让生成的各平台 manifest 保留这一差异，只在 Extension 目标接受该路径。