fix(build): use asar API in runtime verifier

[isYangs]

Summary

• Switch the packaged-runtime verifier from spawning pnpm exec asar extract to using the @electron/asar Node API directly.
• Add @electron/asar as an explicit dev dependency so the Release workflow does not depend on transitive CLI resolution.

Root Cause

• The first verifier fix passed on macOS, but Windows failed while extracting win-arm64-unpacked/resources/app.asar through the spawned asar CLI.
• Using the Node API avoids Windows shell/CLI path behavior and keeps the verifier cross-platform.

Validation

• pnpm install --frozen-lockfile --ignore-scripts
• pnpm run verify:package-runtime
• pnpm run lint