feat: define exact OpenAdapt platform BOM

[abrichr]

Summary

• define the exact OpenAdapt platform bill of materials and compatibility schema
• bind component releases to published artifacts, source commits, hashes, and evidence identities
• generate the public compatibility report and version display from one manifest
• fail closed when required release or compatibility data is missing or inconsistent

Why

OpenAdapt needs one machine-readable platform release contract across the launcher, Flow, Capture, Privacy, Types, Desktop, Tray, and Cloud. This change replaces manually repeated version claims with one validated source and generated documentation.

Impact

The launcher can publish an exact, verifiable component set. The manifest remains strict when validation runs without network access and checks the published artifacts when network access is available.

This PR stays in draft until the Flow 1.26 and Desktop 0.15 releases are complete. The exact component pins will then be regenerated and revalidated before review.

Checks

• python scripts/validate_platform_manifest.py --offline
• python scripts/validate_platform_manifest.py --require-network
• python -m pytest tests/test_platform_manifest_drift.py tests/test_platform_version_display.py -q
• python scripts/check_source_boundary.py
• git diff --check origin/main...HEAD

[abrichr]

Superseded by #1097. The replacement preserves the complete BOM generator, validator, compatibility report, version renderer, drift workflow, release reconciliation, and focused tests on exact #1096 head c4a4f2e. It regenerates current published Flow 1.31.0, Desktop 0.15.0, Types 0.10.0, and related release/schema data instead of carrying this branch’s old assumptions. The feat/platform-bom-v1 branch remains preserved.