Fix MXC dependency metadata and native helper build hashes

[Angnuo (angnuoli)]

Description

Rebuilding MicroClaw for a startup investigation failed first with an MXC package EINTEGRITY error, then with a locally built host-prep hash mismatch. This updates the dependency metadata and expected helper hashes while retaining integrity enforcement.

Review limitation: the helper hashes were reproduced using .NET SDK 10.0.303, now recorded in provenance. This PR does not pin the SDK; CI still requests 10.0.x, so another SDK version may produce different bytes. Toolchain pinning remains a follow-up before relying on these hashes across build environments.

Related Issue

N/A. The runtime-lock permission fix was already merged in #219; this PR contains only build fixes discovered during the reinstall.

Changes

• Refresh the pinned @microsoft/mxc-sdk@0.7.0 lock entry against official npm metadata, including its missing dependencies, without upgrading the SDK package version.
• Align x64 and ARM64 host-prep hashes with freshly compiled artifacts and update provenance with the build SDK.
• Keep package and native artifact integrity checks enabled. No sandbox permission changes or installer binaries are included.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• CI/CD or build configuration change
• Refactoring (no functional changes)

Testing

• Tests pass locally (cd desktop && npm run test)
• Renderer tests pass locally (cd desktop/renderer && npm run test)
• Build succeeds (cd desktop && npm run build)
• Manual testing performed (describe below)

Validation performed on Windows on 2026-09-08:

• Full build.ps1 succeeded, including desktop packaging, portable ZIP, installer ZIP, and setup EXE. Local artifacts are unsigned.
• 396 targeted tests passed: sandbox logic, gateway lifecycle, constants, bundled Windows node host, permission dialog, and native host-prep tests. Full main-process and renderer suites were not run.
• Published host-prep for x64 and ARM64; an additional x64 rebuild reproduced its hash.
• Reinstalled the desktop and uninstaller using the new payload, verified all 120 desktop files against the archive, and confirmed existing configuration files were unchanged during installation.
• Two unattended installed-app launches reached the chat UI with sandbox protection enabled, HTTP 200 health responses, and connected WebSocket. No permission prompts or startup timeouts occurred. The final launch used no remote-debugging port. Startup remained approximately 2.5 minutes; this is not a startup-performance fix.

Checklist

• My code follows the coding guidelines of this project
• I have performed a self-review of my code
• I have commented my code where necessary
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or my feature works
• New and existing unit tests pass locally with my changes

Existing regression tests were used rather than adding tests. The build completed with toolchain/dependency warnings; full-suite and CI validation remain pending.