feat(hardening): 内嵌产品配置 + 系统级状态 + 全量 i18n + 依赖治理 + 资料清理

update-client-hardening 四工作流合入（构建/静态检查已过）：

- 配置：不可变产品策略经 UpdateClientResources.cmake 归一化校验后
  内嵌 qrc（URL/相对路径/主程序必须落 install_root/版本/UUID 格式，
  CMake override 写入前复验）；可变机器状态迁系统级原生存储；
  运行目录不再落可编辑 app_config.json。
- i18n：生产源全英文（no-Han 检查 41/41），中文进 translations/
  zh_CN 目录；翻译加载收敛 Common/TranslationHelper 唯一入口；
  Bootstrap 补资源文件。
- 依赖：Qt/OpenSSL/架构/Perl 机器路径改 imported targets +
  UpdateClientDependencies.cmake，3rdparty 由父工程契约供给。
- 清理：旧 README/SDK README/3 个重复 PowerShell 打包脚本/PDF 提取
  文本删除，canonical README + 5 份结构化英文文档替代；Launcher
  requireAdministrator manifest；统一 MSVC /utf-8 删运行时编码设置。

Common/IntegrityHelper.cpp

@@ -30,13 +30,13 @@ bool IntegrityHelper::runtimeProtectedPath(const QString& path) const
 {
     const QString p = QDir::fromNativeSeparators(path).toCaseFolded();
     QSet<QString> protectedPaths{
-        "bootstrap.exe", "client.ini", "config/app_config.json", "config/local_state.json",
+        "client.ini", "config/app_config.json", "config/local_state.json",
         "config/client_identity.dat", "config/version_policy.dat"
     };
     const QString runtimePrefix = ConfigHelper::instance().runtimeRelativePath().toCaseFolded();
     if (!runtimePrefix.isEmpty()) {
         const QStringList runtimeProtected{
-            "bootstrap.exe", "client.ini", "config/app_config.json", "config/local_state.json",
+            "client.ini", "config/app_config.json", "config/local_state.json",
             "config/client_identity.dat", "config/version_policy.dat"
         };
         for (const QString& protectedPath : runtimeProtected)
@@ -59,11 +59,8 @@ bool IntegrityHelper::verifySignature(const QByteArray& payload, const QString&
 #ifndef HAVE_OPENSSL
     Q_UNUSED(payload); Q_UNUSED(signatureBase64); m_error = "OpenSSL unavailable"; return false;
 #else
-    QString keyPath = QDir(m_installDir).filePath("config/manifest_public_key.pem");
-    if (!QFile::exists(keyPath))
-        keyPath = QFileInfo(ConfigHelper::instance().configPath()).dir().filePath("manifest_public_key.pem");
-    QFile keyFile(keyPath);
-    if (!keyFile.open(QIODevice::ReadOnly)) { m_error = "manifest public key missing"; return false; }
+    QFile keyFile(QStringLiteral(":/simcae/update-client/manifest-public-key.pem"));
+    if (!keyFile.open(QIODevice::ReadOnly)) { m_error = "embedded manifest public key missing"; return false; }
     const QByteArray keyData = keyFile.readAll();
     BIO* bio = BIO_new_mem_buf(keyData.constData(), keyData.size());
     EVP_PKEY* key = bio ? PEM_read_bio_PUBKEY(bio, nullptr, nullptr, nullptr) : nullptr;