Make O2R packing deterministic and contained

[mckinlee]

Summary

• write standalone O2R entries in stable root-relative order with valid fixed ZIP timestamps
• reject symlink escapes and output archives resolved inside their own input tree
• report pack failures cleanly and run one source-free determinism check per hosted platform

Testing

• configured and built the full standalone MSVC x64 Release target with BUILD_UI=OFF
• ran test/pack/validate_deterministic_o2r.py against the built executable (SHA-256 5e4452e3a189491044bf36ffadb0f235a49828f38bd6c15ac49e8bd92d1ad266)
• verified stable bytes after mtime changes, sorted root-relative entries, DOS-epoch timestamps, contained-output refusal, symlink escape rejection, invalid-type diagnostics, and preservation of an existing validation directory
• passed clang-format 14 dry-run, workflow YAML parsing, and git diff --check