Add verified learning-pack asset delivery

[Conalh]

Summary

• add the optional learning-resource.pack-asset@1 contract for learner-controlled notebooks, scripts, datasets, Markdown, text, and YAML files
• re-verify the persisted active release identity, manifest metadata, byte count, and SHA-256 immediately before delivery
• provide explicit browser downloads and a desktop save dialog backed by a bounded atomic native writer
• expose clear pending, saved, cancelled, and retryable-error states without recording save activity as learner progress
• document the trust boundary and pack-authoring requirements

Why

The reusable pack-asset delivery capability existed only on the further-ahead local Practical ML line. Canonical Concourse needed the universal capability without importing that course, its notebooks, or its datasets.

Scope

This PR contains only the reusable Concourse capability, tests, and documentation. Practical Machine Learning course content remains on its separate branch.

Verification

• npm run verify — formatting, lint, typecheck, 476 TypeScript tests, and production build
• cargo fmt --check --manifest-path src-tauri/Cargo.toml
• cargo test --locked --manifest-path src-tauri/Cargo.toml — 24 Rust tests
• npm audit --omit=dev — 0 vulnerabilities
• scope audit confirms no Practical ML course, notebook, or dataset paths

Build note

Vite continues to report the existing JavaScript chunk-size advisory (~1.02 MB); the production build succeeds.