feat: add autonomous campaign asset workflow

[heznpc]

Summary

• harden capture cleanup and expand one product story into CWS/YouTube, X, and YouTube Shorts variants
• add native-select mirrors, visible cursor actions, deterministic focus captions, runtime caption QA, media probing, and thumbnail pixel QA
• add a local Campaign Dashboard with the owner flow: Recipe selection -> autonomous production -> final review
• infer one Recipe per targeted story, let the Recipe own its channel profiles, and persist only the selected Recipe
• keep the existing Calibrator intact as the Advanced/Debug composition surface
• run every Recipe target in one capture attempt so retry budgets and manifests stay campaign-scoped
• bind single and multi-target approvals to the exact displayed media SHA-256 and calibration profile hash
• reject stale candidates atomically and block profile changes while capture is running
• add loopback Host, same-origin, JSON content-type, CSP, malformed-body, and media-symlink protections
• support Campaign production and approval without requiring exception-only calibration

Validation

• npm run lint
• npm test (27 suites, 188 tests)
• npm run pack:check (52 packed files)
• npm audit --audit-level=high (0 vulnerabilities)
• real SkillBridge media browser QA across Plan, Production, Review, and Approved
• desktop QA for 1280x720 and 720x1280 candidates with correct aspect-ratio placement
• mobile QA down to a 305px effective viewport: no horizontal overflow, action/nav overlap, or console errors
• bidirectional Campaign <-> Calibrator navigation with deep-linked target state
• final real state remains user-gated: machine-ready media is not publishable until explicit approval
• GitHub Actions CI passed on commit 983b1a7

Notes

• Existing untracked application-plan docs remain untouched and are not part of this PR.