feat(pm): unified package manager — pm store foundation

Introduce the pm store: a unified, hash-verified package store that
replaces lazy_deps and the old installer's ad-hoc tool downloads.
Store tools are provisioned on PATH (ffmpeg, node/npm via pinned uv),
with a resumable 8-way downloader, verify() returning failure reasons,
and adopt() made EPERM-safe. chromium ships in the payload for every
target. The 3600-line install.sh is replaced by a staged bootstrapper
(heavy deps are pm's job after this); setup-hermes.sh, Dockerfile and
nix pin tables are rewired onto the store. Old install-script tests,
lazy_deps/managed_uv/build_info, and the ps1/bash installer test
batteries are removed with the machinery they tested.

Rebuilt from ethie/pm onto upstream/main (ac6c8028e0) after the
utf-8-sig sweep. 16 hot files (main also churned them) hand-merged:
platform adapters, main.py, electron/main.ts, tui_gateway/server.py,
cua_backend, installer-tests workflow, install.sh (full rewrite),
setup-hermes.sh, plugins doc.

tools/code_kernel.py

@@ -572,7 +572,7 @@ def _spawn(kernel: SessionKernel, *, task_id: str, child_python: str,
     kernel.server_sock = server_sock
 
     tools_src = generate_hermes_tools_module(list(sandbox_tools))
-    with open(os.path.join(kernel.tmpdir, "hermes_tools.py"), "w", encoding="utf-8") as f:
+    with open(os.path.join(kernel.tmpdir, "hermes_tools.py"), "w", encoding="utf-8-sig") as f:
         f.write(tools_src)
     runner_path = os.path.join(kernel.tmpdir, "hermes_kernel_runner.py")
     with open(runner_path, "w", encoding="utf-8") as f: