[codex] chore: finish production readiness issues

[ubugeeei]

Summary

• Add Node package ESM/CJS smoke tests, exact npm pack assertions, public publish metadata, and package README.
• Add typed WASM public declarations plus generated-package runtime smoke and exact pack assertions.
• Add MSRV, supply-chain audit, crate/package dry-run CI gates, release trusted-publishing/provenance workflow, and complete crate/package metadata.

Closes #6
Closes #9
Closes #10
Closes #11
Closes #12
Closes #15
Closes #17
Closes #18
Closes #19
Closes #27
Closes #28
Closes #29

Validation

• nix run nixpkgs#actionlint -- .github/workflows/ci.yml .github/workflows/release.yml
• for f in scripts/*.mjs; do node --check "$f" || exit 1; done
• nix develop .#default --command bash -e -u -o pipefail -c 'pnpm install --frozen-lockfile && pnpm run fmt -- --check && cargo fetch --locked && cargo clippy --locked -p fastsse -p fastsse-node --all-targets -- -D warnings && cargo clippy --locked -p fastsse-wasm --target wasm32-unknown-unknown -- -D warnings && cargo check --locked -p fastsse -p fastsse-node --all-targets && cargo check --locked -p fastsse-wasm --target wasm32-unknown-unknown && cargo test --locked -p fastsse && cargo test --locked -p fastsse-node && pnpm run audit:supply-chain && pnpm run package:dry-run'\n- nix develop .#msrv --command bash -e -u -o pipefail -c 'cargo check --locked -p fastsse -p fastsse-node --all-targets && cargo check --locked -p fastsse-wasm --target wasm32-unknown-unknown'\n- git diff --check\n