feat(authoring): define frozen input metadata codecs

[777genius]

Adds canonical codecs for the frozen-input provenance record and public npm v2 descriptor, allowing both products to bind the same input bytes. This is structural validation only; no runtime, acquisition, signing, staging or publication route is enabled.

Dependent source checkpoint on #216 (408f3b4). N2 independent acceptance remains unresolved. The remainder of C1, actual E2E and release qualification are not completed by these codecs.

Validation: 13 focused Node tests passed, patch/source hashes verified, all 3,372 existing tracked paths preserved. 514 added lines across two files. Independent hosted review ACCEPT at 8c49513: 13 focused tests plus 7 independent cases passed; report hashes verified. Native Windows arm64 CI failed in TestReportsAndFreshFactory with scratch_unavailable; aggregate remains red. No merge/release acceptance.

Refs #216, #210, #203, #208.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}