feat(ts): publish local untrusted JS Podman runtime

[clfhhc]

Summary

• publish the focused D667 host-neutral contract and Node rootless-Podman broker/certifier
• include the package-owned fixed runner assets through focused package subpaths
• bind broker and runner provenance to the package version and align the fixed v0 admission ceilings
• retain closed wave-message direction guards and deterministic runner generation
• regenerate the tracked runner during Changesets versioning so the release commit matches the npm artifact

Changesets computes @graphrefly/ts 0.7.0 -> 0.8.0. The package root and aggregate executor surfaces remain unchanged.

Verification

• Node 24 package build, DTS, and export smoke
• package tests: 118 files / 1855 tests passed; 4 environment-gated skips
• lint and test typecheck
• packed tarball ESM/CJS imports and asset resolution from a clean consumer
• real rootless Podman build from the installed tarball assets
• live Podman 3/3: failure cleanup, real 3N/2E Graph result, independent certification/cancellation/terminal cleanup
• Changesets 0.8.0 simulation regenerated the tracked runner with graphrefly-ts:0.8.0
• three-way release QA: Critical 0 / Major 0 / needs-decision 0