refactor(pack): harden project staging and export paths

[joeykchen]

Summary

• pin and validate project pack inputs, produce deterministic archives, and replace outputs safely
• stage export assets from the logical project while rejecting unsafe paths
• make integration fixtures project-local and normalize media permissions
• split path collection, validation, JSON indexing, and output responsibilities

Validation

• go test -race ./cmd/spx/...
• go test ./...
• go vet ./...
• Windows amd64 pure_engine compile for pack and command
• go mod tidy -diff
• git diff --check

[fennoai]

Reviewed the fixed 7b73af9d73edfeda5a5ee7c33e57e0b78f29ccf9...de056654e58bb71ef608ab7a14bcff3db2685860 diff across pack input validation, deterministic output publication, external asset resolution, and export staging. I found no PR-introduced correctness, security, or compatibility issue that meets the review threshold.

Verification: go test -race ./cmd/spx/..., go vet ./cmd/spx/..., and git diff --check pass. The broader go test ./... run is otherwise green but retains an unrelated failure in internal/projectpolicy/TestPortableConfigSnapshotRejectsIdentityAndContentDrift.