fix(startup): enforce consent before download handoffs

Gate clipboard, extension, and deep-link inputs until startup consent is resolved, and serialize extension readiness transitions so native prompts cannot race the app explanation. Identify consent by the build revision so same-version updates re-enter the consent boundary.

Requested by [this X post](https://x.com/ixabolfazl/status/2077356127763804450?s=20).

src/utils/keychainStartup.test.ts

@@ -3,7 +3,9 @@ import { getKeychainConsentVersion, getKeychainStartupDecision } from './keychai
 
 describe('getKeychainStartupDecision', () => {
   it('changes the consent identity when the credential-access policy changes', () => {
-    expect(getKeychainConsentVersion('1.1.0')).toBe('1.1.0|keychain-policy-2');
+    expect(getKeychainConsentVersion('1.1.0')).toMatch(
+      /^1\.1\.0\|(build-.+|keychain-policy-2)$/
+    );
     expect(getKeychainConsentVersion('')).toBe('');
   });