Hardening: input validation and bounds tightening across 31 subsystems (round 3) (#31221)

Round 3 of the input-validation and bounds-tightening sweep. 56 commits
across 31 subsystems, each commit scoped to one change:

- **install** (6): dependency folder name validation, migration skip
predicates, manifest name copying, binary lockfile patch entries,
off-registry integrity requirements, symlink target normalization
- **fetch / http client** (5): proxy response handling, content-length
parsing, connection pool keying, cross-origin redirect header handling,
host override reset
- **node:http / uws** (4): parser execute handling, server socket
receiver checks, buffered write ordering, parser/data-handler
interaction
- **mysql** (4): handshake packet handling, packet payload bounds, null
marker decoding, temporal value ranges
- **http2** (3): header name buffer sizing, response header value
validation, frame padding bounds
- **shell** (3): interpolated value tracking in the parser, seq loop
termination, rm directory opening
- **node:zlib** (2): write state validation, write buffer lifetime
across async work
- **sql / postgres / sqlite** (4): transaction option validation, array
type name validation, array literal parsing, statement revalidation
around bind callbacks
- **structuredClone** (2): constant pool index bounds, view backing
store tag validation
- **node:fs** (2): async read buffer pinning, vector buffer snapshotting
- **strings** (2): hashed string equality, utf16 length conversion
- **node:crypto** (2): cipher option handling, signature encoding
conversion
- one each: blob, dns, formdata, fs.watch, glob, node:vm, resolver,
router, serve (2), sourcemap, spawn, streams, timers, tls, url,
websocket

Verified with `cargo check --workspace` on all 10 CI target triples and
the per-subsystem test suites for each touched area; no new test
failures relative to a baseline debug build.

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>