feat: enforce default-deny Node capabilities

[mcollina]

Summary

• define a machine-readable disposition for every supported Node built-in and fail worker startup on unreviewed runtime identities or API-surface drift
• enforce denied and mode-dependent modules through a trusted synchronous ESM/CommonJS resolve hook plus independent _load() and process.getBuiltinModule() guards
• verify pre-hardening CommonJS descriptors, post-hardening ESM descriptors, direct nested object surfaces, exported functions, and constructor/prototype chains without invoking accessors
• add an explicit runtime-upgrade checker to the Linux/macOS/Windows matrix for Node 26.5.1, the Node 26.8 API boundary, and current 26.x
• provide a deterministic, non-mutating candidate generator for manual runtime-upgrade review on every supported OS/runtime profile
• classify and deny Node 26.8 ZIP filesystem APIs and Node 26.9 FFI, with alias/mutation/resynchronization regressions across all execution modes
• document the design comparison, capability inventory, loading paths, compatibility tradeoffs, upgrade workflow, measured performance cost, and residual limits

Fixes #4

Validation

• npm test on Node.js 26.5.1: 346 passed, 1 platform-specific skip
• npm test on Node.js 26.9.0: 346 passed, 1 platform-specific skip
• npm run test:node-capabilities on Node.js 26.5.1, 26.8.1, and 26.9.0
• candidate generation on Node.js 26.5.1, 26.8.1, and 26.9.0
• npm run test:types
• npm run test:package
• npm audit --omit=dev (0 vulnerabilities)
• JavaScript syntax checks and git diff --check
• final blocker-only security, portability, acceptance, and documentation reviews
• nine-job Linux/macOS/Windows CI matrix at Node 26.5.1, 26.8.1, and current 26.x