feat(workflows): support scene model artifacts

[DrHepa]

Closes #354

Summary

• add scene as a first-class input and output for model extension nodes
• add a Load Scene workflow source and scene artifact registration
• add a generic typed /generate/from-artifact route while preserving /generate/from-image
• validate scene directories at submission and again inside the runner

Scope

This PR deliberately supports the reviewable model-node shapes needed by scene workflows:

• scene -> mesh
• scene -> scene
• multi-image -> scene

It fails closed for process extensions, mixed/multiple scene inputs, capture, and video. Shared weight groups remain independent in #348.

Shared-weight integration

The Pixal3D consumer requires both this scene contract and shared-weight PR #348. An isolated merge of #348 + #357 + video PR #358 found three overlapping validation conflicts in generator_registry.py, extension-install-utils.ts, and ipc-handlers.ts. The combined resolution preserves scene/video artifact validation, ordered node inputs, and node-specific shared-weight projection.

The integrated state passed an exact six-node Pixal3D registry check, 100 focused Python tests, 9 focused Node suites, TypeScript --noEmit, and the Electron/Vite production build. Either PR can merge first; the later branch must apply the documented combined resolution during rebase.

Security and compatibility

• rejects traversal, absolute and encoded paths, symlink/reparse escapes, malformed manifests, missing referenced files, and oversized scenes
• reserves and strips transport parameters so callers cannot forge the artifact kind or path
• pins queued jobs to the requested composite model ID through the registry, subprocess, and runner boundaries
• keeps existing image-model extensions and /generate/from-image behavior compatible
• registers scene outputs as workflow artifacts rather than attempting to render them as meshes

Validation

• Python: 146 tests passed
• Node test suite: passed
• TypeScript --noEmit: passed
• electron-vite build: passed
• git diff --check: passed

The full packaging build reached a pre-existing built-in dependency reinstall and was interrupted by DNS (EAI_AGAIN); the authoritative Electron/Vite production build passed directly.