feat: native linux-x64-glibc module packages and reviewed license supplements (ADR 0049, ADR 0052)

Implements ADR 0049's deferred native target and ADR 0052's reviewed
license supplements. The proof case is a real module using sharp.
packageFormat stays 1, and `any` is unchanged.

Packager (@ekklesia/module-pack):
- --target linux-x64-glibc. Native or platform-specific packages, found by
  the same generic rule that refuses them in `any`, stay outside the bundle.
- Each native package's production closure is walked through its own
  dependencies, installed optionalDependencies that match the target, and
  required peers. It is copied as real files flat under node_modules/<name>,
  with no links, dev dependencies, declarations, source maps, or other
  platforms' packages. Missing or foreign-platform required dependencies,
  version conflicts, links, foreign machines, and Node.js range conflicts
  fail closed.
- runtime.nodeApi, nodeAbi, and libcVersion are read from the binaries by a
  small ELF reader: the addon's node_api_module_get_api_version_v1 and the
  newest GLIBC_ symbol version needed. No shelling out. A native target with
  no addon is refused.
- ADR 0052 supplements: package-provided material stays primary. An exact
  match on name, version, and ekklesia-content-v1 digest (sorted normalized
  paths with each file's size and SHA-256; no metadata) adds labelled
  material after the package's own. Any mismatch, a declared-licence
  conflict, or a malformed or unreviewed supplement file fails. Missing
  material with no supplement still fails.

Supplement for @img/[email protected]:
- 184 components and 143 unique texts, assembled from the exact upstream
  sources sharp-libvips v1.3.3 builds linux-x64 from: 27 C/C++ libraries,
  glib's gvdb, librsvg's Rust crates (reproduced with cargo tree), the Rust
  standard library at the rustc commit recorded in the binary, plus the
  LGPL-3.0, GPL-3.0, and MPL-2.0 texts. Each source is recorded with its
  SHA-256 in PROVENANCE.md.
- It pins digest ekklesia-content-v1:sha256:50647b0b…, which is identical
  from the installed copy and from the registry tarball.
- LGPL/MPL source-availability determinations stay open, as ADR 0052
  states. Nothing claims they are met.

Verifier (Core):
- linux-x64-glibc is accepted only on a host whose platform, arch, glibc
  family and version, and Node-API version (from Node itself) match.
- Every ELF file must be x86-64; every .node must be an ELF object.
- `any` packages now also refuse node_modules/ and ELF files.
- Contract: native metadata must state nodeApi or nodeAbi, and Linux targets
  libcVersion (ADR 0049).

Proof:
- A checked-in AGPL native fixture packs byte-identically from unrelated
  copies (8.86 MB) and verifies with Core's verifier.
- Extracted elsewhere, it runs a sharp resize and PNG round trip in an
  empty-environment process. Every resolution stays in the package, and
  only the package's addon and libvips plus host system libraries load.

Signage is untouched.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/development/testing.md

@@ -611,6 +611,31 @@ Ekklesia Module Package v1 (ADR 0049) is proven at three levels, all in `pnpm ve
   `..` paths, symbolic and hard links, device nodes and FIFOs, setuid and setgid entries, a second
   top-level directory, and a duplicate entry each fail with their own sanitized code. The backend
   load check runs in a real child process and selects the schema contract from the manifest.
+- `packages/module-pack/tests/native-target.test.ts`: the `linux-x64-glibc` target, with a real
+  native dependency (`sharp`). The checked-in proof module (`tests/fixtures/native-module`) is
+  packed, and the test proves:
+  - the package carries exactly sharp's discovered runtime closure, as real files;
+  - nothing from another platform, and no development dependency, is included;
+  - `runtime` matches what the binaries declare;
+  - the reviewed libvips supplement is merged and labelled;
+  - two packs from unrelated copies are byte-identical.
+
+  Core's own verifier then accepts the package, and the extracted package runs a real image
+  operation in a separate process with an empty environment. Node's resolution hooks and the
+  process's memory map show that nothing resolves or loads from outside the package except the
+  host's system libraries.
+- `packages/module-pack/tests/native-closure.test.ts` breaks the closure rules one at a time, with
+  fake native packages built around the real sharp addon's bytes:
+  - which platform packages are kept and which are left out;
+  - missing and foreign-platform dependencies;
+  - version conflicts, links, a foreign machine, and Node.js range conflicts;
+  - an unneeded native target.
+- `packages/module-pack/tests/supplements.test.ts` proves ADR 0052's mechanism:
+  - the documented content-digest algorithm;
+  - that the loader refuses anything unreviewed;
+  - that supplement material is merged after the package's own and labelled;
+  - that a supplement for another version, digest, or licence fails closed;
+  - that the shipped libvips supplement is intact and pins the installed package exactly.
 - `packages/module-pack/tests/`: the packager against generated fixture modules (payload contents,
   generated `package.json`, metadata, bundled backend with only built-in imports, refusal of native
   and platform-specific dependencies and of unknown or textless third-party licences, explicit