Add binary package for native object inspection

[andrew]

Foundation for brief inspect (see .claude/notes/inspect-binaries.md). binary.Inspect(path) and binary.InspectReader(r, size) report format, architecture, dynamic dependencies, producer strings, embedded Go build info, and heuristic static-link hints for ELF, Mach-O, and PE. Pure stdlib (debug/elf, debug/macho, debug/pe, debug/buildinfo); no go.mod changes.

ELF reports DT_NEEDED, DT_SONAME, and the .comment section (GCC, clang, and rustc all write there). Arch is derived from Machine plus Class and ByteOrder so riscv32/riscv64, ppc64/ppc64le, and the four mips variants are distinguished.

Mach-O reports LC_LOAD_DYLIB via ImportedLibraries plus raw load-command decode for LC_ID_DYLIB, LC_LOAD_WEAK_DYLIB, and LC_BUILD_VERSION. Universal binaries are handled by parsing the fat header directly since debug/macho.NewFatFile rejects FAT_MAGIC_64; each slice is bounds-checked against the declared object size and Go build info is read from the first slice so fat64 Go binaries are covered.

PE reads DLL names from IMAGE_IMPORT_DESCRIPTOR entries in the import directory, since pe.ImportedLibraries is a stub and pe.ImportedSymbols omits ordinal-only imports.

InspectReader wraps the input in an io.SectionReader over the declared size so all parsers are confined to the caller's bounds. Static-link hints come from a starting regex table over .rodata/__cstring/.rdata (zlib, openssl, sqlite via SQLITE_SOURCE_ID, libcurl, pcre2, libpng, libjpeg-turbo, libwebp, libxml2, brotli, lz4, zstd, libffi, mbedtls, expat, c-ares, boringssl) and are reported as low-confidence.

Tests cross-compile testdata/hello to nine GOOS/GOARCH targets at test time so all three formats are exercised without checking binaries into the repository, plus a lipo -fat64 fixture on darwin. TestInspectSelf covers the host format via os.Executable().

Not in this PR: PE Rich header, cargo-auditable .dep-v0, systemd .note.package, and the soname→purl mapping.