Wintermute 0.2.6 — self-contained OTP target system

The seventh step of the 0.2.x line and the second with no transpiler change:
pure CLI/release tooling extending the 0.2.5 release builder.

• wm release --self-contained produces a standalone OTP target system tarball
  (<app>-<vsn>.tar.gz, unpacking into a single <app>-<vsn>/ dir) that Ops runs
  on a host with NO Erlang installed via ./bin/start. No wm, no system Erlang,
  no secret in the artifact.
• Bundles ERTS (systools:make_tar {erts}); non-local boot (paths resolve from the
  bundled $ROOTDIR/lib); sasl in the .rel; assembled in Go: unpack -> start_clean.boot
  • RELEASES via erl -> top-level bin/ (erts launchers + generated self-locating
    bin/start/bin/stop) + start_erl.data -> repack. Relocatability is free (modern erts
    self-locates). Cookie via OTP-default ~/.erlang.cookie (no -setcookie, no secret).
• New: internal/pkg/release/{archive.go (mode-preserving, traversal-guarded tar
  extract/repack), target.go (WriteLauncherLayout)} + launcher text helpers. No
  transpiler change; wm start unchanged.
• Ladder rung VII: the real artifact unpacked and booted via bin/start under a fully
  scrubbed environment (no system Erlang) -> {global,echo} -> hello.

Reviews folded in: real-OTP integration corrected two assembly assumptions
(make_tar names the boot start.boot; make_tar omits vm.args); the final whole-branch
review fixed a tar-bomb (artifact now unpacks into one dir); the Copilot gate caught
a shell-injection via --vsn into the generated launchers (new validVsn) and a
swallowed TarGz close error. All fixed with regression tests.

Verification: build clean; go test ./... green; 23 integration ladder rungs + the
0.2.5 e2e + rung VII on real OTP 29.0.3; govulncheck/gitleaks clean; gosec only-HIGH
is the accepted G703 taint class (G115 fixed, G110/G122 annotated).

Signed-off-by: Boris Mühmer 328183+bsmr@users.noreply.github.com