Add native bun.lockb patching for hosted and vendored modes

[Mikola Lysenko (mikolalysenko)]

Binary Bun projects previously required conversion to a text lockfile for hosted patches and could not be vendored. This adds native parsing and rewriting of bun.lockb formats 1–3 for hosted patches, vendoring, transitions between those modes, repair, and scoped rollback.

Direct binary patching is the default and only bun.lockb path. Remove the binary-to-text conversion code, legacy migration-ledger replay, migration warnings, conversion tests, and obsolete documentation. Retain text bun.lock support and hosted ↔ vendored mode transitions; binary projects remain binary through patching and rollback.

Preserve package identity, dependency topology, metadata, integrity, and Bun's lock hash. Handle historical binary format upgrades, workspace representations, production dependency filtering, and workspace-local tarballs for older readers. Invalid or drifted binary state refuses before mutation.

Validation on final commit f3ad1c5:

• All 200 PR checks passed. Main CI and Bun compatibility are successful.
• Full local workspace suite: 7,317 passed, zero failed, 99 ignored across 239 suites. Clippy passed across the workspace with all features and warnings denied. The final two assertion-only cleanup tests also passed.
• All 79 native binary writer/reader pairs passed: 25 on Ubuntu 22.04, 16 on Ubuntu latest, 25 on macOS, and 13 on Windows. The matrix covers 17 Bun releases, including complex production dependencies, transitives, bins, scripts, dev dependencies, and both scoped rollback orders.
• All 3,015 public-service compatibility cases passed across 45 OS/release jobs: 2,784 accepted flows and 231 expected text-workspace refusals. The final results used zero harness per-case retries.
• Two Windows public-service jobs initially encountered explicit upstream HTTP 503 responses while downloading prebuilt tarballs. Their isolated CI reruns passed on the same commit with unchanged code and assertions; original failure evidence was retained.

Historical Linux readers run on Ubuntu 22.04 because official Bun 0.5.9–0.6.8 binaries segfault during pristine installs on the Ubuntu 24.04 runner, before Socket Patch runs. All historical acceptance cases remain required, and newer releases also run on Ubuntu latest.

See docs/testing/bun-compatibility.md for the matrix, historical reader limits, and reproducible commands. Bun versions before 0.5.9 cannot install tarball resolutions; their binary locks are validated with compatible newer readers.