feat: add standalone cross-platform Node validator

[anusbutt]

Outcome

Establish a platform-neutral TypeScript validation core, generate the standalone repository-local Node validator, and cut graphkeeper check over to it while retaining the existing shell validator as a compatibility fallback.

This PR contains Phase 1 parity foundations and Phase 2 production check cutover only. It does not rewrite the Git hook, remove jq/sh prerequisites, change query/update, or claim native Windows support.

Evidence

Focused parity and Phase 2 tests were added before the production cutover. Verification completed on Windows with the legacy Git Bash/jq compatibility tools available where required:

• 29 focused Phase 2 tests passed.
• Consolidated functional/security/package suite: 294 passed, 3 expected Windows skips.
• Isolated performance suite: 5 passed.
• npm run typecheck passed.
• npm run validator:check passed.
• npm run package:smoke passed.
• Clean-install onboarding and tarball execution coverage passed.

Checklist

• Tests cover valid, invalid, and relevant security or performance paths.
• Documentation and examples reflect changed behavior within this phase.
• Schema compatibility is unchanged.
• Constitution principles and append-only/evidence guarantees remain satisfied.
• npm run build passes.
• npm run typecheck passes.
• Relevant full functional, security, package, and performance suites pass.
• npm run package:smoke passes and the tarball contains intended assets only.
• No secrets, credentials, telemetry, generated archives, or unrelated edits are included.

Compatibility and recovery

The Node and shell validator paths have differential tests for diagnostics, ordering, contexts, history, staged snapshots, and exit behavior. Existing repositories with an unchanged package-owned shell validator can gain the Node artifact conservatively; modified legacy validators remain authoritative and are not silently replaced. The shell validator remains available as a fallback for unmigrated repositories.

Native Windows support is not claimed by this PR; hook, query, prerequisite, update, CI, and documentation work remain phased separately.