fix: reject manifest CRLF bypasses

[ken-jo]

Summary

• add an explicit CR/LF negative guard to every pattern-constrained host manifest field
• add a recursive regression test so future pattern fields cannot omit the guard
• reject terminal LF/CR in plugin IDs and minimum app versions

Why

ECMAScript-style regular-expression end anchors can match before a terminal line feed. The schema therefore needs an explicit negative guard rather than relying on $ alone.

Validation

• bun run typecheck
• focused Electron Vitest: 1 file, 39 tests
• pre-push: 1,012 passed files / 1 skipped; 12,886 passed tests / 43 skipped
• full build and static policy gates passed

Companion SDK and Marketplace snapshots are being updated separately.