merge: incorporate main fixes into dev + disable auto-deploy

Merge origin/main (3 commits): credential resolver, WhatsApp native release,
exec hardening, traces UI, storage cache fix, desktop defaultValues fix.

18 conflicts resolved — keep dev's v3 structure, incorporate main's new
additions (user_identity_resolver, shell_path_exemption, credentialed_exec).

Release workflow changed from auto (push main) to manual (workflow_dispatch)
to prevent accidental deployments.

.github/workflows/release.yaml

@@ -1,8 +1,13 @@
 name: Release
 
 on:
-  push:
-    branches: [main]
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Dry run (skip publish)'
+        required: false
+        default: 'false'
+        type: boolean
 
 permissions:
   contents: write