feat(plugin-js): scaffold JS/TS plugin, hermetic js_install driver

[raphaelvigee]

M0+M1 of the JS/TS heph plugin plan (part 1/6 of the stack).

First-party JS/TS ecosystem plugin, mirroring the plugin-go/plugin-go-cdylib two-crate split (logic crate + thin stabby cdylib wrapper — a loadable dylib, not a compiled-in builtin).

• Provider: package.json discovery, pnpm-workspace.yaml + npm "workspaces" member resolution.
• js_install: hermetic per-(name,version,integrity) dependency fetch, SRI verification, platform baked into the cache key, postinstall scripts off by default with an explicit allowlist enforced before any network I/O.

Reviewed by feature-quality/code-quality/hermeticity; a tar-slip symlink escape and an uncacheable (host-toolchain-dependent) lifecycle-script hash were found and fixed, each with a regression test.

Test plan

• cargo build -p plugin-js -p plugin-js-cdylib
• cargo test -p plugin-js
• cargo clippy -p plugin-js -p plugin-js-cdylib --all-targets -- -D warnings
• cargo fmt --check -p plugin-js -p plugin-js-cdylib

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}