test(linux): harden source-startup dependencies

[IgnoreMeBut]

Follow-up to #40. PR #40 remains the owning implementation for the Linux startup fix; this PR adds regression coverage, native verification, and precise platform documentation.

Summary

• cover the pinned OfficeCLI mappings and SHA-256 values for Linux x64 and arm64;
• verify runtime path resolution for both Linux architectures;
• verify unsupported Linux Whisper provisioning is skipped while supported macOS and Windows targets remain required;
• add an Ubuntu x64 smoke job that fetches the pinned OfficeCLI binary and verifies its SHA-256, --version, and view --help contract;
• document the glibc x64/arm64 boundary, Alpine/musl exclusion, and unavailable Linux local speech transcription.

Merge order

Merge #40 first using a merge commit, then merge this PR. This branch is based on #40 and the current main; after #40 lands, this PR retains only the hardening changes.

Non-goals

• no Linux packaged installer;
• no system-PATH OfficeCLI fallback;
• no change to the official macOS and Windows download targets.

Verification

• node scripts/run-tests.mjs run test/main/util/officecli-fetch.test.ts test/main/util/ensure-dev-dependencies.test.ts test/main/paths.test.ts — 32 tests passed;
• the same focused tests passed under the workflow direct-Node command;
• npm run typecheck;
• node bin/officecli-policy-gate.cjs;
• git diff --check.

[Orkas-AI]

The stacked diff now contains only the regression, native Linux smoke, and documentation hardening. Focused tests, typecheck, and the OfficeCLI policy gate pass.