Wire encrypted startup and migration readiness into production monitoring

[tanRdev]

Problem

The v2 monitoring runtime is wired, but intentionally remains MigrationReadiness::Pending. Production must not start Gmail intake until the encrypted state store, legacy migration, restart normalization, and recovery outcomes have completed durably.

Acceptance criteria

• Resolve the application data path and acquire the StateKey from macOS Keychain.
• Run AtomicStateStore initialization and legacy plaintext migration/recovery.
• Load and normalize acceptance state; cross any required durability barrier.
• Keep monitoring stopped for key loss, tamper, unknown schema, or migration recovery.
• Call MonitoringHandle::set_migration_readiness(Ready) only after authenticated startup is safe.
• Add packaged-runtime tests for first run, migration, restart, recovery, disconnect, and shutdown.
• Run npm run verify:code and a native app bundle.