补齐游戏分发跨账号越权用例并统一送审的 404 口径

- 新增 scripts/check-game-distribution-owner-isolation.mjs：对本地真实栈注册两个账号，逐条验证私有版本读取、上传状态、分片写入、分包确认、送审、撤回与未认证访问的越权口径，并验证请求体伪造 owner 不生效
- api-server 的 submit_version 改用 load_owner_version_or_404：他人送审返回 404 而不是 403，不再用错误码泄露版本是否存在
- package.json 注册 check:game-distribution-owner-isolation
- 游戏分发里程碑阶段 A 第 1 条改为已勾选，写入 21 项 PASS 取证与修复前的 403 变异证据

package.json

@@ -74,6 +74,7 @@
     "check:generated-bindings": "node scripts/check-generated-bindings.mjs",
     "check:game-distribution-dto-parity": "node scripts/check-game-distribution-dto-parity.mjs",
     "check:game-distribution-media-e2e": "node scripts/check-game-distribution-media-e2e.mjs",
+    "check:game-distribution-owner-isolation": "node scripts/check-game-distribution-owner-isolation.mjs",
     "check:production-ops": "node scripts/check-production-ops-guardrails.mjs",
     "check:preview-deployer": "node scripts/check-preview-deployer.mjs",
     "check:maintenance-page": "node scripts/check-maintenance-page.mjs",