sea: mount bundled assets as a virtual file system - #65675

The tool was one directory of JavaScript that doubled as a library by
accident. This makes the library the point: `src/` is TypeScript compiled
to ESM in `dist/`, every capability has a declared entry point, and the
CLI is a thin wrapper over the same functions an embedder gets.

Four things are now separately importable, which is the shape the rest of
the design needs:

  .           create / sign / verify / inspect / run, from code (api.ts)
  ./record    the -r preload that writes down what a run reads
  ./register  the -r preload that mounts only what is signed
  ./sea       build and boot a self-validating executable

plus ./provider, ./recorder, ./cli, ./manifest, ./archive, ./files,
./skill, ./sigstore and ./oidc for the layers underneath. The package root
deliberately does not re-export the two providers: importing either needs
node:vfs, and creating or verifying an archive does not, so a plain
`import '@pipobscure/bundle'` must not drag `--experimental-vfs` in.
There is a test that holds that line.

The sources are erasable-syntax-only, so `node src/main.ts` runs them
directly under node's type stripping. That is what lets the tests import
the sources rather than the build, and a preload be `-r ./src/register.ts`.
@types/node carries neither the node:zlib ZIP API nor node:vfs's provider
registry, so `src/types/` declares them; the shapes were checked against
the running runtime rather than transcribed from documentation.

sea.js is replaced by src/sea.ts. The old bootstrap was a copy of
manifest.js inlined into a CommonJS file, which had drifted: its signature
marker regex was still the two-field form, so it read every
sigstore-signed container as unsigned. The replacement mounts this package
out of the SEA blob with node:vfs and requires the real library from
there — the userland form of nodejs/node#65675, with the difference that
the mount running the application is the signed archive appended to the
file. Nothing is duplicated, and the verifier a container runs is the one
the test suite tests. `bundle sea` builds one.

Three bugs the type checker and the new tests turned up, all real:

  * --identity and BUNDLE_IDENTITY were only consulted on the sigstore
    path, so an archive signed against an ordinary CA — which carries no
    identity claim at all — satisfied a policy demanding one. A machine
    configured to run only releases from a workflow would have mounted
    anything key-signed. It now reports valid-untrusted.

  * Arguments beginning with `--` never reached a mounted application;
    node claimed them as its own flags. mountArgv() now ends with `--`.

  * Verifying from a Buffer crashed, and sigstore signing was written
    against @sigstore/bundle v2 while v3 is installed. Both fixed, and the
    Buffer path now has a test.

131 tests over the format, both providers, the API, the CLI, the SEA and
the published package's own shape, replacing three JavaScript suites.