feat(fnos): run entirely without root and harden process lifecycle

- Switch privilege model to run-as: package (zero root, per fnOS guide)
- Borrow App Store python312 instead of bundling CPython; keep bundled uv
- Move venv, HOME and caches onto the persistent data share
- Start service via setsid; stop/upgrade kill the whole process group
- Sweep stray runtime/box orphans in install/upgrade init hooks
- Track LangBot 4.10.11 (manifest baseline + upstream merge)

packaging/fnos/cmd/uninstall_callback

@@ -7,8 +7,7 @@ if [ "${wizard_keep_data:-yes}" = "no" ]; then
     # 应用运行数据（pid、日志等）
     if [ -n "${TRIM_PKGVAR}" ]; then
         rm -rf "${TRIM_PKGVAR:?}"/langbot.pid \
-               "${TRIM_PKGVAR:?}"/langbot.log \
-               "${TRIM_PKGVAR:?}"/bin 2>/dev/null || true
+               "${TRIM_PKGVAR:?}"/langbot.log 2>/dev/null || true
     fi
 
     # 共享数据目录（langbot/data）