feat(runtimebundle): verify portable runtime archives

[joeykchen]

Summary

Extracts the Driver-independent archive identity and verification foundation from #1753.

• Strictly decode canonical bundle manifests and reject duplicate or unknown JSON fields.
• Validate portable entry names, Unicode/case-fold collisions, modes, sizes, and full SHA-256 identities.
• Verify ZIP offsets, overlap, compression ratio, quotas, file types, and content before extraction.
• Extract through pinned os.Root handles and fail closed on source mutation, symlink traversal, or destination replacement.
• Apply private POSIX modes and current-user-only Windows DACLs.

The archive layer no longer depends on cache implementation details: digest helpers and reserved metadata names live with bundle verification. Redundant compatibility aliases and mutable global default limits were removed.

This PR contains no cache, download/acquire, Project Driver, launcher, release, or process-supervision code.

Verification

go test -race ./internal/strictjson ./internal/runtimebundle
go vet ./internal/strictjson ./internal/runtimebundle
go mod tidy -diff
GOOS=windows GOARCH=amd64 go test -c -o /tmp/runtimebundle.test.exe ./internal/runtimebundle
go test ./...

Follow-up

After merge, the transactional cache/lock layer can build on this package in a separate PR, followed by acquire/download. #1753 will rebase and remove each merged foundation from its diff.

[fennoai]

The manifest strictness, archive bounds, ZIP offset checks, content hashing, extraction confinement, and cross-platform build paths were reviewed. The Windows permission seam is not connected to extraction, so the current-user-only DACL contract is not enforced for the extraction root and regular files. Focused tests, race tests, vet, GOOS=windows GOARCH=amd64 go test -c, go mod tidy -diff, and go test ./... passed.