P6: security soak, axe a11y sign-off, signed air-gapped bundle tooling

- Concurrency soak (exit criterion): 12 concurrent gated runs, every
  decision attempted twice concurrently, explicit resumes racing the
  durable sweeper — exactly one execution per approval, grants consumed
  at most once, every decision audited, zero stuck runs, zero unaudited
  executions. (Testkit pool raised to 20 connections; the 5-connection
  pool starved the storm.)
- axe a11y sweep (exit criterion): serious+critical violations fail CI on
  login, shell, chat, computer home, settings app, all global pages, and
  the wizard. Two real violations found and fixed: aria-label on a plain
  div (wizard progress -> role=group) and a button directly inside a <dl>
  (settings -> plain bordered list).
- tools/bundler (exit criterion): keygen / assemble / verify CLI — copies
  artifacts, writes manifest.json + sha256 checksums.txt + a detached
  ed25519 signature; verification is fully offline (keyless signing is
  internet-dependent and disqualified). Tests: round trip, tampered
  artifact caught by hash, tampered checksum list caught by signature,
  wrong key refused, missing artifact reported.

147 Rust + 63 frontend tests + 27 Playwright journeys (incl. 4 a11y).

Co-Authored-By: Claude Fable 5 <[email protected]>

frontend/src/components/computer/apps/SettingsApp.tsx

@@ -154,10 +154,10 @@ export default function SettingsApp({ agent }: { agent: Agent }) {
         <p className="text-sm font-medium">{live.name}</p>
         <p className="text-xs text-muted-foreground">{live.job_title}</p>
       </div>
-      <dl className="rounded-(--radius) border border-border bg-subtle text-xs">
+      <div className="rounded-(--radius) border border-border bg-subtle text-xs">
         <div className="flex justify-between border-b border-border px-2 py-2">
-          <dt className="text-muted-foreground">Managed by</dt>
-          <dd>{settings.data?.managed_by_name ?? "…"}</dd>
+          <span className="text-muted-foreground">Managed by</span>
+          <span>{settings.data?.managed_by_name ?? "…"}</span>
         </div>
         <button
           type="button"
@@ -166,7 +166,7 @@ export default function SettingsApp({ agent }: { agent: Agent }) {
         >
           Edit profile <span aria-hidden>›</span>
         </button>
-      </dl>
+      </div>
       <p className="pt-1 text-xxs uppercase tracking-wide text-muted-foreground">
         Who else has access
       </p>