Add bounded end-to-end kernel and desktop CI after crate baseline

[stakach]

Migrated roadmap scope. Historical context: completion ledger.

Dependencies: #4, #18.

Acceptance

• Design separately provisioned native/microkernel and QEMU lanes after reliable crate CI.
• Pin image/toolchain inputs, cap boot at one hour and collect terminal diagnostics/screenshots on failure.
• Assert real Explorer launch/rendering and failure ownership; serialize shared images and avoid synthetic proof.

Track progress and verification here and in PRs. Host specs, native builds and end-to-end proof are distinct; retire superseded machinery at its actual cutover.