fix(cluster): make bounded source reading runtime-portable

[tomdps]

Parent

• feat(cluster): validate GraphSpec and input before remote allocation #883
• Follow-up for PR feat(cluster): validate GraphSpec and input before remote allocation #891
• Review: feat(cluster): validate GraphSpec and input before remote allocation #891 (comment)

Problem

src/cluster/json-source.ts exports readBoundedSource from the standalone @the-open-engine/zeroshot/cluster client, but the implementation uses the Node-only Buffer global. Browser and other non-Node consumers fail with ReferenceError: Buffer is not defined.

Scope

• Replace Node-only Buffer use in the bounded JSON source reader with runtime-portable Web/ECMAScript primitives such as Uint8Array and TextDecoder.
• Preserve the exact byte ceiling, chunked async-source support, strict UTF-8/JSON behavior, abort behavior, and existing ClusterRequestError codes/messages.
• Avoid copies beyond the bounded assembled payload and keep size accounting in bytes, not decoded characters.
• Add contract tests that run with globalThis.Buffer unavailable and cover multibyte UTF-8 split across chunks plus the exact/over-limit byte boundary.
• Keep the public @the-open-engine/zeroshot/cluster package host-agnostic. Do not add Node polyfills or a Node-specific export.
• Do not change unrelated E2E cleanup-race tests; PR feat(cluster): validate GraphSpec and input before remote allocation #891's current CI failure is an unrelated ENOTEMPTY cleanup race and the new commit will naturally rerun CI.

Delivery

Target the existing PR #891 head branch through a dependent PR whose base is zeroshot/platinum-forest-30. The parent PR must remain paused until this fix lands and all required checks pass.