PR04: Add packaged starter projects and safe initialization

[aniaisec]

The demo previously copied resources from a repository checkout, preventing a wheel installation from providing a complete first-run experience. Add packaged starter resources and safe project initialization, and make the seven-stage demo work from an installed wheel outside the checkout.

• Add cua init PATH --template demo|web|windows with dry-run previews, full destination preflight, exclusive writes, rollback on failure, symlink refusal, and unique private project signing keys. Existing edits and secrets are preserved.
• Package editable TOML/YAML/JSON, guides, environment examples, discovery/security scripts, and the Windows sample app through importlib.resources. All starter capabilities are drafts; keys and review receipts are never bundled.
• Add cua demo, reuse the same resources for demo setup, remove checkout path injection, and explicitly describe/approve synthetic capabilities within each session.
• Add an installed-wheel CI job that checks resources, initializes every template, serves mock HTML, and runs the seven-stage browser demo with PYTHONPATH removed and cwd outside the checkout.

Validation: CI passed for the P04 commit, including quality, browser/security, benchmark, and installed-wheel checks. Local verification passed 900 non-browser tests, Ruff, and Linux/Windows type checks. The final non-editable wheel demo used zero replay model calls and made exactly one consented commit. One Windows symlink test was skipped for missing local privileges; live Windows UIA was not exercised.

This PR contains P04 only, ending at 6fd8128. The later P05 diagnostics commit on codex/adoption-pr04 is excluded.