Add platform-managed multiACE package contract

[Tareku99]

Summary

• Add the platform-neutral managed-mode contract: shared marker/environment variables, managed install/update guards, managed UI messaging, and clean provider defaults.
• Include the Gen 1 tag tunnel and web preflight post-processor in the allowlisted managed archive while excluding the standalone installer, uninstaller, updater, config merger, and file-copy mode switch.
• Preserve the standalone installation and self-update path for stock-firmware users.
• Keep host-side ACE settings write-through unchanged; other platform-specific settings destinations remain a follow-up if needed.

Managed environment contract

• MULTIACE_MANAGED
• MULTIACE_MANAGED_MARKER
• MULTIACE_APP_DIR
• MULTIACE_CONFIG_DIR
• MULTIACE_PRINTER_DATA

Related to the shared settings/path discussion in #142; the adapter-discovery proposal there is not part of this PR.

Build and release flow

• Every push and pull request runs validation and builds a check package.
• After this workflow is on the default branch, a manual run can build a selected branch, tag, or commit. It uploads the standalone and managed archives, SHA-256 sidecars, and source metadata as a 14-day Actions artifact only; it creates no tag or GitHub Release and does not expose the test package through the standalone updater.
• Stable publication remains tag-driven: a v<VERSION> tag must match multiace/VERSION. The workflow publishes both archives and checksums, with GitHub-generated release notes categorized by .github/release.yml.

Validation

• Managed package/unit tests: 7/7 passing, including archive contents, clean config, reproducibility, and exclusion of Python bytecode.
• Managed-boundary guard and standalone updater asset-selection tests pass.
• Provider Python compilation and frontend JavaScript syntax checks pass.
• The managed archive builds with its checksum; the workflow will run again on this pushed revision.

[decay71]

Thanks, this is a clean piece of work. I built the managed archive from this branch and ran your tests locally: the unittests, the guard tests and the updater asset selection all pass, and #151 merges into main without conflicts. Since #151 carries all commits of #150, I will review and merge #151 only and close #150 afterwards.

Three things before I merge:

1. Manifest: two files are missing from the payload

klipper/extras/ace_gen1_tunnel.py (added with #146). The archive only takes what the manifest lists, so the next release would ship a managed package without the Gen 1 tag tunnel. I checked the built archive: the file is not in it.
tools/post_process_virtual_toolheads.py. Excluding tools/ as a whole also drops the post-processor, and the web preflight loads it from the package root (_load_post_processor in main.py). Without it the preflight either fails with 503 or falls back to a stale copy under printer_data/config/tools/. Please keep excluding the installer, updater and config merger, but ship this one file.
2. Test builds should not become public releases

The manual workflow_dispatch run publishes a regular GitHub prerelease with a v...-test. tag. Everyone with write access can trigger it from any branch, and users who enabled MULTIACE_UPDATE_PRERELEASE would be offered it as an update. Publishing releases should stay with me. Could the test run upload the two archives as workflow artifacts (or create a draft release) instead? Both are visible to maintainers only, so you can still test with them.

3. README

I maintain the main README myself, so please drop the README change from this PR. The section is already covered by multiace/managed/README.md.

Once these are in, I will merge.

Dirk