fix: verify current ZAP1 proof bundles

[Zk-nd3r]

Summary

• replace the obsolete WASM-loader package with a zero-runtime-dependency JavaScript verifier
• enforce exact ZAP1_COUNT_BOUND_V2 proof shapes, positive bounded leaf counts, and fail-closed metadata parsing
• retain historical duplicate-odd verification only behind explicit opt-in and the frozen anchor-height gate
• expose the canonical 18-type registry while limiting typed client-side leaf hashing to the two implemented formulas
• add reproducible build, provenance, packed-install, Node 18/20/22, and Chromium gates

The linked protocol registry was reconciled first in Frontier-Compute/zap1#5.

Validation

• source suite: 23/23 passed
• packed clean-install and Chromium matrix passed
• exact eight-file tarball allowlist passed
• independent Python hashlib.blake2b boundary vectors passed
• npm audit --omit=dev: 0 vulnerabilities
• staged source and dist BLAKE2b SHA-256: 5546B1C22EB13F60E9F45C1B358CB4FDCD8CCC77C3F2E039BBC5E3C057D39FC5

Version 0.2.0 is post-window compatibility and verifier-hardening maintenance; 0.1.3 remains the historical March-May artifact.