Add CLI Chrome-supervised QA runner foundation

[Hector-Ha]

What to build

Build the first maintainer-only QA runner path for Chrome-supervised QA. The runner should be a separate binary, not part of normal InstantRepo.exe, and should use shared Desktop Actions so Wails and QA call the same Product Core behavior.

This slice should prove the core path end to end: a maintainer can run a QA command, get a QA Plan Preview, start a local Chrome-supervised QA surface, and see the runner call approved InstantRepo actions through a loopback Local QA Bridge with a per-run token.

Acceptance criteria

• A separate instantrepo-qa command exists and is not built into the normal Wails release artifact by default.
• The command supports preview and run modes for at least one simple scenario path/id.
• preview prints target repo, scenario list, allowed actions, network policy, file-change policy, temp folders, cleanup plan, and evidence paths without cloning, saving, installing, or changing repo state.
• run starts a loopback-only Local QA Bridge with a per-run token and opens or prints a local Chrome QA URL.
• QA bridge exposes approved Desktop Actions only and does not expose raw shell command execution.
• Shared Desktop Actions are used by both Wails and QA, or the implementation creates the shared boundary needed for both shells to converge.
• Normal InstantRepo.exe has no QA bridge activation path and cannot be enabled by analyzed repo files, repo .env, or target repo state.
• Run output records app branch, commit, dirty status, and changed file list instead of requiring a clean tree.
• Go tests cover the runner/bridge safety behavior through public interfaces.

Blocked by

None - can start immediately.

Notes

See docs/adr/0003-use-cli-chrome-supervised-qa-harness.md and CONTEXT.md QA terms.