Run npm package-management workflows inside wasm-rquickjs

[noise64]

• resolves GOL-58
• runs the Node 22.14/npm 10.9.2 CLI inside fresh asynchronous execution jobs with isolated argv, environment, cwd, output, exit status, cancellation, and timeout behavior
• covers local and deterministic-registry installs, npm ci, offline cache restoration, dependency selection, tree inspection and mutation, init, pack dry-run, and compatible JavaScript lifecycle and run scripts
• persists package, lockfile, cache, and node_modules changes for later fresh jobs, including a transform-enabled TypeScript workspace importing an installed JavaScript dependency
• fills the runtime primitives npm requires across Buffer, zlib, v8, URL, module loading, child-process emulation, HTTP, and runtime services
• rejects native addons, unavailable host executables, arbitrary shell behavior, and unsupported custom raw-socket transports explicitly
• documents the supported command, flag, package, and npm/npx compatibility matrix
• TODO: GOL-388 will add real-symlink package identity and successful persisted .bin, npm exec, npx, workspace, npm-link, and pnpm-style workflows

Node compatibility

• primary CI-enforced: 3236/4425 (73.1%) → 3236/4411 (73.4%)
• full-public passing count: unchanged at 3236
• node:http: 246 passing unchanged; 14 custom-transport cases move from known-gap to WASI-impossible
• no compatibility success is claimed for the reclassified raw-socket surfaces