## Why

Run distributions currently produce a secret-bearing archive with a sidecar `config.json`, and downloaded Windows packages are ZIP files. Operators need the platform to deliver one server-scoped executable whose platform URL and runtime authorization are compiled into the binary.

## What Changes

- Change platform-managed Run distributions to publish a single raw executable instead of a ZIP/tarball plus `config.json`.
- Inject Run platform URL, worker mode, runtime identity, key generation, and authorization token through Go `-ldflags -X` during the trusted Run build.
- Increase Run component key entropy without changing the global session/job token generator.
- Allow Run self-update jobs to consume raw executable artifacts for Windows and Linux targets.
- Add run-key reset to the server-list "运行操作" dangerous menu, using the existing reset API.
- Revoke the active Run control session when the run key is reset so old deployed binaries stop immediately.

## Capabilities

### New Capabilities

- `secure-single-file-run-distribution`: Server-scoped Run executable distribution, compile-time authorization injection, raw-binary self-update, and list-level run-key reset.

### Modified Capabilities

- None.

## Impact

- Affects `platform/` distribution build input, run-key generation/reset behavior, artifact naming, package-format validation, and tests.
- Affects `run/` config loading, distribution build packaging, self-update extraction, protocol DTOs, and tests.
- Affects `platform_web/` server-list runtime action menu and tests.
- Does not touch plugins, client-manager package format, AI provider flows, billing/cloud features, or unrelated UI systems.