fix(workbuddy): repair product-specific installation and repeat setup

[gofenix]

WorkBuddy installations could write into the wrong product directory and miss a running Electron host, leaving OpenGUI unavailable or lifecycle Hooks ineffective. The installer now reads the selected application metadata, checks the 5.5.3 minimum and Hook declarations before downloads, and detects the application and its helpers before configuration writes.

Host configuration and runtime state remain separate. Each configuration root has its own installation receipt; explicit legacy repair restores only unchanged installer-owned files. Unknown same-name MCP entries are preserved. Verified downloads and installed dependencies are reused, and unchanged configuration returns ALREADY_CONFIGURED. This prepares the independent WorkBuddy 0.2.1 repair candidate and updates installation guidance.

Validation:

• 121 tests, TypeScript build, package validation and release assets passed.
• Preflight regressions cover product/custom directories, old versions, Electron/helper processes, unknown products and missing Hook declarations.
• Configuration tests cover legacy repair, independent instance receipts, idempotence, foreign MCP conflicts and symlink protection.
• Real packaged stdio startup, 11-tool registration and isolated read-only ADB discovery passed with fresh and offline caches.
• Full macOS installer fixture: cold install 63.2 s; repeat install 1.3 s; package directory reused.
• The previous installer (version constant normalized for the fixture) failed the running-Electron regression by incorrectly succeeding.
• Direct read-back of the locally installed configuration connected to OpenGUI 0.2.1, registered 11 tools, and discovered one connected device without operating it.
• Local WorkBuddy 5.5.3 installation succeeded; real running-host refusal verified; local repeat install approximately 3 s.

GitHub push CI passed on Node 22/24 and packaged startup on macOS, Linux and Windows: https://github.com/Core-Mate/OpenGUI/actions/runs/34228661977

Remaining acceptance: desktop task submission stayed disabled during UI validation, so host-level tool invocation, Hook continuation/stop and phone acceptance are not claimed. Owen's overseas build still needs retesting. Stable-release readiness flags remain false; no Release is published by this PR.