Add secure WPT input preparation and adaptation

[andrewiggins]

Summary

• add a private WPT runner package with a pinned upstream revision and SHA-256 archive checksum
• validate archive paths and links before extraction, then publish revision-addressed caches atomically
• serialize concurrent preparation with bounded waiting and abandoned-lock recovery
• serve prepared WPT files through canonical path containment with ETag revalidation
• adapt supported top-level HTML/SVG markup and classic scripts into generated source without executing it

Boundary

This PR ends at generated WPT source. It does not create a polyfill Window, execute WPT code, classify capabilities, or add CI. The stacked execution PR consumes this generated source. Standalone tests cover archive preparation and canonical path containment; browser execution and end-to-end ETag/smoke validation arrive in the stacked PR.

Validation

• pnpm run lint
• pnpm run type-check
• pnpm exec vitest run
• pnpm wpt:prepare
• focused archive-preparation and served-path tests

Changeset

An empty changeset records that this private test infrastructure releases no public package.

[andrewiggins]

Superseded by the three-PR replacement stack:

1. Source preparation: Add pinned WPT source preparation #630
2. Interactive runner: Add an interactive Web Platform Test runner #631
3. Capability enforcement and CI: Enforce Web Platform Test capabilities in CI #632

The replacement stack gives each PR a self-contained executable outcome. These branches are being preserved temporarily for recovery; this PR is closed without merging.