build: provide governed project archive tools

[Daxiongmao87]

Description

• add the tracked target-owned .agentic-delivery/Dockerfile on immutable Node 24.11.0, with zip, unzip, Git, networking diagnostics, and Chromium dependencies required by the authoritative repository commands
• keep package_module and the package regression unchanged; the image supplies their declared executables
• move executable-runtime ownership fixtures off the governed worker's noexec /tmp without bypassing the production executable probe

Fixes #190
Fixes #191

Empirical Verification (UTRs)

Test Execution Commands Run:

docker build --pull=false --network=default --file .agentic-delivery/Dockerfile --tag simulacrum-project-issue-190:local .
docker run <governed non-root/read-only envelope> simulacrum-project-issue-190:local node --version
docker run <governed non-root/read-only envelope> simulacrum-project-issue-190:local zip -v
docker run <governed non-root/read-only envelope> simulacrum-project-issue-190:local unzip -v
docker run <governed envelope, /tmp noexec> simulacrum-project-issue-190:local node --test tests/unit/global-setup-ownership.test.mjs tests/unit/teardown-ownership.test.mjs
docker run <governed envelope, /tmp noexec> simulacrum-project-issue-190:local npm run test:local

Empirical Output/Logs:

Docker build:
  image sha256:733c5a32be12b65ebd78d64c12d5827033fbff52b1785b1d21c60911ac11436b
  base node:24.11.0-bookworm-slim@sha256:76d0ed0ed93bed4f4376211e9d8fddac4d8b3fbdb54cc45955696001a3c91152
  build completed successfully

Runtime capability probes under --read-only --cap-drop ALL --security-opt no-new-privileges --user 10002:10003:
  node --version: v24.11.0
  zip -v: This is Zip 3.0 (July 5th 2008)
  unzip -v: UnZip 6.00 of 20 April 2009, by Debian

Authoritative package command under the same hardened envelope:
  > simulacrum@1.0.1 package:module
  > node tools/package-module.js
  [pack] Packaging simulacrum@1.1.0 -> /workspace/project/dist/simulacrum-1.1.0.zip
  [pack] Created /workspace/project/dist/simulacrum-1.1.0.zip

Focused governed runtime ownership tests with /tmp mounted noexec:
  tests 8
  pass 8
  fail 0
  cancelled 0
  skipped 0
  todo 0

Repository-owned offline gate in the target image with /tmp mounted noexec:
  required-test policy: pass; no skip/focus/quarantine/retry-to-pass markers
  static: pass; ESLint baseline 74 present / 74 allowed / 0 new
  unit: 35 passed / 0 failed / 0 skipped
  regression: pass; 2 Node tests passed plus compaction budget checks
  integration: 2 passed / 0 failed / 0 skipped
  component: 1 passed / 0 failed / 0 skipped
  security: 2 passed / 0 failed / 0 skipped
  package: 1 passed / 0 failed / 0 skipped
  npm run test:local exit status: 0

[Daxiongmao87]

Independent review found that the first image revision relied on test-only HOME/npm-cache overrides. I reproduced the defect under the exact governed envelope: npm ci exited 254 because the non-root process could not create /.npm on the read-only root.

Corrected in db2fa0e:

• image now sets HOME=/tmp/home
• image now sets npm_config_cache=/tmp/npm-cache

Fresh verification with no launcher environment overrides:

• rebuilt image: sha256:b75a20894bd76efff51b8f3c496f5ac36f1e3a1c20ddef212dc261e9b3c5cd4b
• exact-envelope npm ci: exit 0, 333 packages installed
• exact-envelope npm run test:local: exit 0
• policy/static/unit/regression/integration/component/security/package all passed; zero failed and zero skipped tests