Hosted Home: the user's own client verifies the signed code before it handles keys #211

Part of #209 (user keys and private data that the host cannot read).

Releases and capsules are signed, but on a hosted Home nothing on the user's side checks those signatures: the browser runs whatever page the operator serves, so a changed page could capture a key during a normal unlock.

Done means

• Keys and decryption for a hosted account run only in a client the operator does not control (the user's installed ElastOS app, or a signed browser extension or app). That client verifies the maintainer signature and hash of every capsule asset it runs, with the maintainer DID pinned on the user's device. Test: a page or capsule asset changed by the operator is refused, and no key is released.
• The hosted Home stores and relays only data that this client has encrypted. Test: with the full data folder, root access and control of the served pages, the operator cannot read a hosted user's wallet key or private data.
• Wallet signing for hosted accounts happens in that client, behind the approval surface (Runtime-owned approval surface for every approval, with the passkey bound to what is shown #178). Test.