launcher 0.2.0: inline status icons + classified update-check + token auth wire

- Async update-check per module on init (git.start_ls_remote_tags),
  polled per frame. Result classified into available / no-update /
  fail / local-only via the new kind field from lib-core.git 0.2.0.
- Pre-emptive dep-check per module (depf.ensure_for_module) on init
  populates a dep_check_result whose ok/conflicts/warnings/errors
  drive the icon strip.
- Inline icon strip per module-row (icons.lua): rotating ASCII
  spinner while pending, yellow warn for auth/network failures or
  dirty deps, blue update-badge with target version (clickable to
  trigger fetch+checkout), red error for dep-check conflicts, gray
  L for repos that genuinely don't exist on the server. Tooltip on
  hover shows the specific reason per icon.
- Click handler splits launch-vs-update by hit-testing the badge
  rect before the row rect. Launch is blocked when dep-check failed.
- On init, reads engine.config("gitea_token") and forwards via
  git.set_token so users can persist their token in their user-data
  engine.json layer instead of using an env var.
- New deps: lib-core.git 0.1.0, lib-management.dep-fetcher 0.1.2.

manifest.module

@@ -1,12 +1,14 @@
 {
   "id": "lib-management.launcher",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "kind": "module",
   "api": "^0.1",
   "ci_frames": 10,
   "name": "Sporel Launcher",
   "entry_point": "init.lua",
   "deps": [
-    { "id": "lib-core.input", "version": "0.4.0" }
+    { "id": "lib-core.input",            "version": "0.4.0" },
+    { "id": "lib-core.git",              "version": "0.2.0" },
+    { "id": "lib-management.dep-fetcher", "version": "0.1.2" }
   ]
-}
+}