fix: decode Runtime DSSE provenance for v0.1.9

[hututuQQQ]

Summary

• decode the production Runtime provenance as a bounded canonical DSSE envelope instead of treating it as a raw SLSA statement
• require valid UTF-8, the in-toto/SLSA types, and Sigma's portable Runtime build type before matching version/platform/architecture
• add coverage that accepts the production envelope contract and rejects raw statements
• bump coordinated Sigma Code desktop metadata to 0.1.9; immutable failed publication tags are not moved

Validation

• focused desktop/release Vitest: 37 passed
• real locally generated Runtime DSSE envelope accepted and bound to win32-x64
• pnpm build:desktop
• pnpm typecheck
• pnpm lint
• retained integrated app snapshot reports codex/release-v0.1.9