feat: bundle native binaries in root package

[steipete]

Summary

• collapse the unpublished native loader and seven platform-package graph into the single @openclaw/fs-safe package
• load the matching bundled binary from dist/native/<target>/fs-safe-native.node while preserving non-executing musl detection and auto / require / off behavior
• build seven target artifacts, fail closed while collecting them, validate one packed tarball, and publish only the root package with provenance
• update release prerequisites and public documentation for the deterministic-install versus package-size tradeoff

Proof

• pnpm check
• pnpm test:security
• cargo test --workspace --locked
• cargo clippy --workspace --locked -- -D warnings
• actionlint .github/workflows/*.yml
• pnpm docs:site
• all seven native targets built and assembled locally
• packed artifact installs and imports; host native load passes; removing dist/native falls back in auto and throws helper-unavailable in require
• tarball: 6,099,269 bytes gzipped; 18,739,144 bytes unpacked
• autoreview clean

No tag or release is created by this PR.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: feat: bundle native binaries in root package This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.