feat: reviewed libvips 1.3.4 supplement, and the native proof on sharp 0.35.5

sharp 0.35.4 carries a production-relevant librsvg advisory (GHSA-wq5f-xc86-pv6w). Its fix, sharp
0.35.5, loads @img/sharp-libvips-linux-x64 1.3.4, which ships no licence material either. This adds
the reviewed supplement for that exact package (ADR 0052) and moves the packager's native proof to
sharp 0.35.5, so a later 0.2.1 release can package it on linux-x64-glibc. Nothing in module-pack's
code changes: supplement selection is already by exact name, version, and content digest.

- Supplement: license-supplements/@img/sharp-libvips-linux-x64/1.3.4/
  - content digest ekklesia-content-v1:sha256:2927fe11493461fa34847191d0b9b1c6441007c3e99f306e5708cb07fb0a5e59;
  - 190 components and 146 hashed texts;
  - assembled with the same method as 1.3.3's, from sharp-libvips v1.3.4's own inputs. That method
    reproduces the 1.3.3 supplement byte for byte.
  - PROVENANCE.md records:
    - the 27 upstream archives and five build-time patches, by sha256;
    - the librsvg 2.63.2 crate reproduction (cargo 1.99.0; Cargo.lock 5723e14c…);
    - rustc 75a75c3e…;
    - every change from 1.3.3.
  - Notable: sharp-libvips v1.3.4 now states cairo is used under MPL 1.1, not MPL 2.0. cairo ships
    that text itself, so the standard MPL 2.0 text is no longer added for cairo; selectors still
    carries it.
  - No legal conclusion: the LGPL and MPL source-availability determination stays open, as for 1.3.3.
- The 1.3.3 supplement is unchanged, and still proven: module-pack keeps sharp 0.35.4 as a test-only
  devDependency alias (`sharp-0.35.4`). Each supplement is pinned against its real installed
  libvips, and each matches only its own.
- Native proof fixture: sharp 0.35.4 → 0.35.5. The closure has the same shape: sharp, @img/colour,
  detect-libc, semver, and @img/sharp-linux-x64 0.35.5 with @img/sharp-libvips-linux-x64 1.3.4.
  The runtime read from the binaries is unchanged: Node-API 9, glibc >= 2.28, x86-64.
- Docs: the module guide's note on available supplements.

No version bump, no publication, no tag.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/module-pack/tests/native-target.test.ts

@@ -28,7 +28,7 @@ const execFileAsync = promisify(execFile);
 const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const repositoryRoot = path.resolve(packageRoot, "..", "..");
 const LIBVIPS_DIGEST =
-  "ekklesia-content-v1:sha256:50647b0b1e0b99943f24e4a1580650c0d8fe7744779b0f16271dcd2d59a7678c";
+  "ekklesia-content-v1:sha256:2927fe11493461fa34847191d0b9b1c6441007c3e99f306e5708cb07fb0a5e59";
 const CLOSURE = [
   "@img/colour",
   "@img/sharp-libvips-linux-x64",
@@ -139,18 +139,18 @@ describe.runIf(onTargetHost)("the linux-x64-glibc target, proven with sharp", ()
       expect(at, name).toBeGreaterThan(0);
       expect(notices.slice(at, at + 400), name).toMatch(/Used in: (?:backend, )?node_modules/u);
     }
-    const libvips = notices.indexOf("\n@img/sharp-libvips-linux-x64 1.3.3\n");
-    const nextEntry = notices.indexOf("\n@img/sharp-linux-x64 0.35.4\n");
+    const libvips = notices.indexOf("\n@img/sharp-libvips-linux-x64 1.3.4\n");
+    const nextEntry = notices.indexOf("\n@img/sharp-linux-x64 0.35.5\n");
     const section = notices.slice(libvips, nextEntry);
     // The declared licence is the package's own, unchanged.
     expect(section).toContain("License: LGPL-3.0-or-later\n");
     expect(section).toContain("[Reviewed license supplement]");
     expect(section).toContain(LIBVIPS_DIGEST);
     expect(section).toContain("not legal review");
-    expect(section).toContain("[libvips 8.18.6: LICENSE]");
-    expect(section).toContain("[@img/sharp-libvips-linux-x64 1.3.3: GNU LGPL version 3]");
+    expect(section).toContain("[libvips 8.18.7: LICENSE]");
+    expect(section).toContain("[@img/sharp-libvips-linux-x64 1.3.4: GNU LGPL version 3]");
     // Other packages carry their own shipped licence text, with no supplement.
-    const sharp = notices.slice(notices.indexOf("\nsharp 0.35.4\n"));
+    const sharp = notices.slice(notices.indexOf("\nsharp 0.35.5\n"));
     expect(sharp).toContain("[LICENSE]");
     expect(sharp).not.toContain("[Reviewed license supplement]");
   });
@@ -226,10 +226,10 @@ describe.runIf(onTargetHost)("the linux-x64-glibc target, proven with sharp", ()
     }
     const native = outcome.mapped.filter((file) => /\.(?:node|so)(?:\.|$)/u.test(file));
     expect(native).toContain(
-      `${extractTo}/node_modules/@img/sharp-linux-x64/lib/sharp-linux-x64-0.35.4.node`,
+      `${extractTo}/node_modules/@img/sharp-linux-x64/lib/sharp-linux-x64-0.35.5.node`,
     );
     expect(native).toContain(
-      `${extractTo}/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.18.6`,
+      `${extractTo}/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.18.7`,
     );
     // Everything else is the host's own system libraries; nothing from the workspace.
     for (const file of native) {