…leDependencies (#436 follow-up)

Replaces the MVP `files`-field-only packlist with a faithful port of
[`npm-packlist`](https://github.com/npm/npm-packlist) /
[`pnpm/fs/packlist`](https://github.com/pnpm/pnpm/blob/94240bc046/fs/packlist/src/index.ts).
Four passes:

  1. Walk via `ignore::WalkBuilder` configured for `.npmignore` +
     `.gitignore` per-directory inheritance.
  2. Apply the `files`-field allowlist on top, compiled into a single
     `Gitignore` matcher.
  3. Always-include `package.json`, `README*`, `LICEN[SC]E*`,
     `CHANGES*`, `CHANGELOG*`, `HISTORY*`, `NOTICE*` at the root, plus
     `main` / `bin` paths — these override `.npmignore` *and* the
     `files`-field filter, matching npm-packlist's `alwaysIncluded`.
  4. Recurse into `bundleDependencies` (and the legacy
     `bundledDependencies`) under `node_modules/<name>/`. Each
     bundled dep gets its own `packlist()` pass and the result
     splices in under its name. Accepts both `[<name>]` arrays and
     `true` (bundle every entry in `dependencies`, npm's lesser-known
     shorthand).

New runtime dep: `ignore = "0.4.25"` (BurntSushi, used by ripgrep;
MIT/Unlicense, `cargo deny` clean). Replaces the hand-rolled
`*` / `**` / `?` glob matcher in the old packlist.rs — the new
matcher uses `ignore::gitignore::GitignoreBuilder::add_line`, which
gives us full gitignore semantics (negation, anchored vs unanchored,
directory-suffix rules) for free.

Two intentional divergences from upstream documented in the module
header:

  - When both `.npmignore` and `.gitignore` exist in the same
    directory, `ignore` combines their rules; npm-packlist would
    use only `.npmignore`. Same outcome for the common case (a
    `.npmignore` that's a strict superset); divergence only when
    `.npmignore` explicitly includes a path `.gitignore` excludes
    (rare in published packages).
  - `.git/info/exclude` and global `~/.gitignore` are NOT honored.
    The fetcher operates on a clean tarball / checkout, not the
    user's working tree.

Tests: 7 new packlist tests cover `.npmignore` exclusion,
`.gitignore` fallback when no `.npmignore`, always-included
override of `.npmignore`, per-subdir `.npmignore` inheritance,
`bundleDependencies` subtree inclusion, legacy `bundledDependencies`
spelling, and the missing-bundle-dir graceful skip. All 7 existing
packlist tests still pass under the new implementation (the
`*` / `**` / `?` glob assertions still hold because the `ignore`
crate's globset is a superset of what the old matcher did).

…versal, dir-vs-basename excludes (#468 review)

Four CodeRabbit findings on the npm-packlist port:

- **`WalkBuilder::parents` defaults to `true`**. `ignore` would
  search above `pkg_dir` for `.gitignore` / `.npmignore` and apply
  them to the walk; for a packlist the pack must depend only on the
  package's own contents. Adding `.parents(false)` to the builder
  isolates the walk to `pkg_dir`. Test:
  `npmignore_in_parent_dir_does_not_leak_in` plants a `.gitignore`
  in the temp parent and asserts `index.js` still ships.
- **`bundleDependencies` path traversal**. `bundle_name` was joined
  into `pkg_dir/node_modules/<name>` without validation; a malicious
  manifest with `bundleDependencies: ["../../etc"]` could escape.
  New `is_safe_bundle_name` runs the same `Component`-based check
  `cas_io::join_checked` uses: only `Normal` and `CurDir` components
  pass; `ParentDir`, `RootDir`, `Prefix` are refused. Scoped names
  like `@scope/foo` still pass (their `/` resolves under
  `node_modules`, not above it). Test:
  `bundle_dependencies_rejects_path_traversal`.
- **`should_always_exclude` over-eager segment walk**. The single
  list mixed dir-typed exclusions (`.git`, `.svn`, `.hg`, `CVS`)
  with file-typed exclusions (`.npmrc`, lockfiles, debug logs).
  Splitting into `ALWAYS_EXCLUDED_DIR_SEGMENTS` (matched at any
  segment) and `ALWAYS_EXCLUDED_BASENAMES` (basename-only) keeps
  the VCS-state filter while removing the dead double-fire on
  files. Test: `always_excluded_dir_segments_only_match_vcs` plants
  both a `lib/CVS/Root` (must exclude) and `lib/cvs-tools.txt`
  (must include).
- **`files_field_includes` leaf fallback was redundant *and* wrong**.
  `Gitignore::matched` correctly handles unanchored patterns at any
  depth (verified empirically: `cli` matches `bin/cli`). The leaf
  fallback was dead code. But it also failed to handle the
  directory-include case (`files: ["cli"]` should include
  `lib/cli/index.js` if `lib/cli` is a directory matching the
  pattern). Switch to `matched_path_or_any_parents`, which walks
  ancestor segments and returns `Ignore` when any segment matches.
  Test: `files_field_bare_basename_matches_at_depth` pins root +
  nested file + directory-match cases.

No production code touched outside `packlist.rs`. 18 packlist tests
pass (14 from the first commit + 4 new regressions). `just ready`:
925 → 925 passes locally.

…ain/bin (#468 review round 2)

Two more CodeRabbit findings:

- **Recursive `packlist()` had no depth limit or cycle detection.**
  A bundled dep whose own `bundleDependencies` points back at itself
  (or any symlink loop in `node_modules`) would stack-overflow the
  fetcher. Refactor `packlist` into an inner `packlist_inner` that
  threads a `HashSet<PathBuf>` of canonical visited paths plus a
  `depth: u32` counter through every recursion. `fs::canonicalize`
  resolves symlinks so a loop shows up as the same path; the
  `MAX_BUNDLE_DEPTH = 32` is a belt-and-braces guard against any
  cycle the canonical-path check can't see (filesystem mount
  tricks, etc.). Test:
  `bundle_dependencies_self_cycle_is_caught` plants a symlink loop
  through `node_modules/self/node_modules/self`, declares a
  self-bundling manifest, asserts the recursion is cut after one
  level.
- **Pass 3 force-included `main` / `bin` without consulting
  `should_always_exclude`.** A manifest with
  `"main": "package-lock.json"` would re-add the lockfile after
  pass 1 filtered it. Run both `main` and `bin` paths through
  `should_always_exclude` before insertion — the always-excluded
  set wins over manifest fields, matching npm-packlist's silent
  override. Tests:
  `main_field_pointing_at_always_excluded_basename_is_refused`
  (lockfile case) and `bin_field_pointing_at_vcs_segment_is_refused`
  (`.git/`-prefixed path case).

No production code changes outside `packlist.rs`. Local test count:
925 → 928. `cargo deny`, dylint, doc-deny-warnings all green.