chore: optimization audit batch (ICO, BaseBuilder, CLI errors, CI lanes)

A grab-bag of follow-ups from the project audit:

feat(icon): generate full multi-resolution Windows ICO (#1190)

ensureMultiResolutionIco re-renders user-supplied ICOs through sharp so
every Windows standard size (16/24/32/48/64/128/256) is present in the
output, and exact-size PNG frames already in the source are preserved.
Avoids the Windows shell having to downsample 256x256 to 16x16 for the
tray, which produced the blurry tray icons reported in #1190.

refactor(builders): extract env helpers from BaseBuilder

Move package-manager detection, build env, install command, Cargo
mirror toggling, and the linuxdeploy strip-error matcher into a new
bin/builders/env.ts module. BaseBuilder drops from 626 to 481 lines
and becomes pure orchestration. Tests migrate from accessing private
methods on BaseBuilder to calling the module-level functions directly.

refactor(cli): top-level error boundary with PakeError

Wrap program.action in try/catch, route user-facing failures through
a PakeError class for short messages, and only print stack traces in
debug mode. Replace the lingering process.exit(1) inside
options/index.ts with a thrown PakeError so behavior stays consistent
with the rest of the pipeline.

test: snapshot CLI options to window config contract

Extract buildWindowConfigOverrides from mergeConfig as a pure
function and snapshot it across darwin/linux/win32. Catches CLI
option drift early instead of waiting for a real build.

ci: split PR fast lane from full Tauri build

quality-and-test now runs vitest + tests/index.js --no-build on every
PR/push (about 5 minutes per OS) and only runs the full real Tauri
build on push to main or manual dispatch. Replaces the broken
hashFiles('~/.cargo/bin/cargo-hack') cache with
taiki-e/install-action so cargo-hack downloads a precompiled binary.

Plus type-gate hardening (rollup noEmitOnError: production) and Node
version doc alignment in both READMEs (>=22 recommended LTS, >=18
also works), matching package.json engines.

Co-authored-by: Cursor <cursoragent@cursor.com>