feat: harden cross-platform package and runtime

[JimmyDaddy]

Summary

• harden npm conditional exports, optional React Native peers, and real packed-consumer ESM/CJS/browser/type checks
• add RN 0.73/0.74/0.86 Android API compatibility builds, cross-platform golden device assertions, malformed-patch fuzzing, resource limits, and Web cancellation
• reuse the shared Web Worker/WASM runtime, record a reproducible benchmark, and strengthen native C cleanup/error behavior
• complete bilingual docs, site evidence, changelog/security policy, Dependabot, and contribution templates

Verification

• yarn prepare, yarn typecheck, yarn lint, yarn test --runInBand
• yarn test:web, yarn test:web:browser (including active abort twice), yarn test:web:metro, yarn test:package
• FUZZ_RUNS=2000 yarn test:fuzz
• Android RN compatibility: 0.73.11 old/new, 0.74.7 new, 0.86.0 new
• Android example clean test assembleRelease on legacy and New Architecture with JDK 17
• yarn site:build, yarn site:test, yarn site:test:browser
• actionlint, shellcheck scripts/*.sh, git diff --check
• npm pack --dry-run --ignore-scripts (111 KiB packed, 390 KiB unpacked, 56 files)