feat(app): add sandboxed scientific script workflow

[nmrtist]

Summary

• add a read-only .plotxscript workflow for processing selected project datasets
• resolve datasets referenced by multi-selected canvases while preserving stable resource IDs
• run scripts in a constrained Rhai sandbox with filesystem imports disabled and explicit resource limits
• process inputs in the background and retain results or errors for every dataset
• render script-defined summaries and allow complete JSON results to be saved
• register script execution in the shared command catalog
• separate scientific scripts from registered tools in the Automation interface

Security

• reject filesystem module imports
• bound operations, collection sizes, strings, variables, functions, nesting, and serialized output
• expose only prepared read-only dataset snapshots to scripts

Testing

• cargo pr-check
• regression coverage for sandbox imports and allocation limits
• selection, stable-ID, per-input error, command-catalog, and optional LC-method coverage

Dependency

Depends on #48. Review and merge #48 first; after it merges, this PR's diff against main will contain only the scientific script workflow changes.