fix: support ZCode 3.3.4 safely

[rldyourmnd]

What changed

• update the verified ZCode baseline to app 3.3.4 (build 3.3.4.2877) and CLI 0.15.2
• repin all six official macOS/Linux artifacts by exact size, SHA-512, architecture, signing, package, and bundle identity
• preserve the desktop task index, legacy sessions, and bot definitions together with CLI session state
• reject apply-mode target mutations when SQLite databases are open or recovery sidecars are present

Why

ZCode 3.3.4 changed the active runtime baseline. The previous selective restore contract copied the CLI session database without the desktop task index, which could leave cross-store session references inconsistent after a setup switch.

Validation

• fast harness lane
• full private suite: 460 passed
• macOS and Ubuntu isolated lifecycle and benchmark lanes
• native macOS bootstrap harness
• Ruff, Pyright, ShellCheck, JSON validity, and diff checks
• manual native verification of all six official 3.3.4 artifacts