fix(release): vendor the keyring platform bindings into the CLI tarball

The packed CLI must install with npm --offline against an empty cache, so
the keyring cannot be an ordinary registry dependency. Vendor the napi-rs
keyring and all twelve platform bindings into the package as a bundled
dependency, each fetched at build time and verified against an exact
pinned tarball digest, with the platform bindings nested under the keyring
package so its per-platform require resolves offline. The post-install
invariant now asserts exactly the bundled keyring dependency and that its
vendored tree landed (the offline install itself still proves nothing is
fetched), and check.mjs pins the new assertion plus the digest-pinned
download path.

Verified locally end to end: bundle, vendor, npm pack (11.9 MB), offline
global install with an empty cache, vendored tree present, and bc help.

Co-authored-by: Cursor <cursoragent@cursor.com>