fix(sdk): preserve sealed-file identity on Windows Node 22

[kmbroai]

Summary

Accept the same checked regular file on Windows Node 22 when path and open-handle metadata represent the volume identifier differently.

Changes

• Keep exact device identity checks on non-Windows platforms and whenever ordinary metadata already agrees.
• On Windows device mismatches only, compare the original file with a second independently opened no-follow handle using exact full-precision descriptor device and inode identities.
• Continue requiring a regular non-symlink file, unchanged original numeric inode, identical full-precision path inode, unchanged checked parents, and unchanged final path identity.
• Add regressions for volume identifiers larger than JavaScript's safe integer range, differently represented numeric inodes, changed exact inodes, non-regular files, and strict non-Windows behavior.
• Load the installed SDK's bundled sealed-scan example with the actual Node runtime during package verification so Windows Node 22 genuinely exercises this path.

Testing

• Complete sealed-scan contract suite: 30 passed with 97 assertions.
• Built, packed, installed, and validated the public SDK, including its real Node-runtime sealed-scan contract smoke.
• Captured actual Windows Node 22 diagnostics proving path and file-handle device identifiers differ even in their low 32 bits, then verified exact same-API descriptor identity instead.

Risk and rollout

• File access remains fail-closed; no symlink, ownership, parent, inode, or scan-seal checks are removed.
• Kept separate from the security-finding publication feature stack because it also protects existing scan consumers.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.