chore(tools): add external-tools.json with fleet-canonical schema

[John-David Dalton (jdalton)]

Summary

Ships external-tools.json at the repo root using the fleet's canonical schema:

https://raw.githubusercontent.com/SocketDev/socket-btm/main/packages/build-infra/lib/external-tools-schema.json

The tools: map covers the universal build prerequisites the repo uses — git, node, pnpm, gh — plus the CI-only security tooling (zizmor, sfw-free, sfw-enterprise) with sha256-verified checksums pulled from socket-registry's pinned entries.

Each entry carries both human-facing fields (description, version, notes — for doctor-style reporting) and machine-verify fields (repository, release, checksums — for CI download+verify). One file drives both surfaces.

Why this shape

• Canonical schema reference: $schema points at the socket-btm-hosted JSON Schema that every fleet repo validates against. Editors + CI validators pick up the single source of truth.
• tools: wrapper: matches socket-packageurl-js, socket-sdxgen, and every socket-btm/packages/*/external-tools.json. (socket-registry currently uses the flat shape for its active CI tooling; that can converge later.)
• Per-platform sha256 checksums: matches the pins in socket-registry's external-tools.json so a future composite action in this repo can download + verify pnpm / zizmor / sfw the same way.

What this PR does NOT change

• No workflow changes. The schema file is consumed by:
  • editors / schema-aware validators (via the $schema URL)
  • future setup-and-install actions that want to pin pnpm / zizmor / sfw the same way socket-registry does
  • a future doctor command that reads the tools map to report what's installed vs expected
• No code touches. Purely a scaffolding addition.

Test plan

• $schema URL resolves in a schema-aware editor (VS Code JSON language server picks it up)
• jq .tools.pnpm.version external-tools.json returns the pinned version
• Existing CI remains unchanged

[John-David Dalton (jdalton)]

Bill Li (@billxinli) James Tu (@jmsjtu) review bump — this adds external-tools.json with the fleet-canonical schema. Branch just updated against latest main. One of you good to take a look?