Share the Orbit e2e launch harness and strengthen the skills-refresh smoke

Follow-up from the #181 review.

Two test-quality items:

1. `app/test/e2e/skills-refresh.spec.ts` copies ~95 lines of launch/isolation boilerplate from `smoke.spec.ts` -- `packagedExecutablePath()`, the tmp HOME/cwd/userData setup, the scrubbed `isolatedEnv`, and the `electron.launch` call. Extract a shared `app/test/e2e/harness.ts` (e.g. `launchIsolatedOrbit()` returning `{ app, page, tmpRoot, errors }` + cleanup) and have both specs use it, so the platform-path and creds-scrubbing logic has one home.

2. The skills-refresh smoke asserts the cache clears + the agent restarts + the confirmation message, but not that the replacement agent comes up healthy or that a refreshed catalog is actually produced (deferred because it needs LLM creds in the sandbox). A follow-up should drive a real turn with creds and assert catalog recreation + the offline-preservation case.

Start with app/test/e2e/smoke.spec.ts and app/test/e2e/skills-refresh.spec.ts, comparing their launch, isolation, and cleanup setup before introducing app/test/e2e/harness.ts. Confirm both specs use the shared harness, then exercise the skills-refresh smoke with credentials. Done means the replacement agent is healthy, the catalog is recreated, and the offline-preservation case is covered.

Written by the indexing model from the issue text.