fix(widget-dev): give dev-session listings a source so a sourced install cannot pick them

[mrgoonie]

What

Widget dev-session listings now carry a directory source of their own, widget-dev (kind widget-dev), so #571's source rules apply to them like any other listing.

• readNodeDirectory (apps/runtime/src/application/widget-dev-store.ts) records WIDGET_DEV_DIRECTORY_SOURCE as the origin of every dev listing, in all three cases: no source configured, remote sources with nothing to list, and a composed directory. Dev listings stay in front, so a listing key shared with another source resolves to the session's listing, as the entry lookup already did.
• The contract's directorySourceKindSchema gains widget-dev. The change only adds a kind: generations recorded before it still parse.
• A dev session's installs name that source (sourceId: "widget-dev" on the request and on its reused consent approval). The session's own idConflict check still guards the package id, and generations installed before this change, which recorded no source, are not refused on their next rebuild.

Why

Before this change, a dev listing had no origin. On a fresh node (official Marketplace on but never fetched, no index file) the session's collision check could not see an id@version that a marketplace lists once it is fetched. After that fetch, pressing Install on the marketplace card (which sends its sourceId) passed sourceRefusal because the found entry had no origin, and it installed the dev session's files under a card that named another source. It now answers 409 DIRECTORY_SOURCE_CHANGED, and what runs stays the session's build.

Tests

New block in apps/runtime/test/widget-dev-sessions.spec.ts that runs with the node's defaults: no index, no custom feed, official Marketplace on.

• A sourced install from a feed that is fetched only after the session activated is refused with DIRECTORY_SOURCE_CHANGED. The generation records widget-dev, and the next build is refused with PACKAGE_LISTED. This test fails on main, where the install is accepted and no source is recorded.
• New coverage for the default fresh-node path, which the vitest config's CC_OFFICIAL_MARKETPLACE=off had hidden. With the Marketplace on but never fetched and no index file, a session activates and serves its files. With a broken index file, activation is refused with DIRECTORY_UNREADABLE.

Verification on 43e8f21:

• focused: widget-dev-sessions, marketplace-directory-install, update-checks, directory-sources, contracts, marketplace-directory-sources, open-interfaces: 58 files and 1044 tests passed
• pnpm typecheck: passed
• pnpm invariants: all 14 checks passed (docs/manifest.json rewritten for the two edited widget-development docs)
• eslint on the changed files: clean
• pnpm verify: passed (561 test files, 7495 tests passed, 37 skipped)

Docs

docs/open-interfaces.md and docs/widget-development.md describe the widget-dev source and the refusal, with their Vietnamese pairs. Official docs (clarkcant-web) are not affected: they do not describe directory source ids or this refusal.

Notes

An install approval for a dev build that was still pending when the node upgraded recorded no source. After the upgrade the inbox hides it, and a decision on it answers DIRECTORY_SOURCE_CHANGED, because its recorded source (none, so the index file) no longer matches. That session's build stays waiting until the approval is resolved or expires. This only affects dev builds that were waiting when the upgrade happened (#531 merged hours ago), so no migration path was added.

Fixes #583
Refs #496, #531, #571

[mrgoonie]

Review attestation: ready to merge at b45ab4f516b95265ec414cb2dce93f577359bb85, reviewed by agent:code-reviewer.

A push to this PR makes this attestation stale; the new head needs its own review.