Harden Bombadil artifact delivery for v0.7.9

[0thernet]

Summary

• reconcile the terminal-green Bombadil lifecycle and artifact-delivery work with the prepared v0.7.9 release surfaces on current main
• keep public CI uploads bounded to sanitized summary and receipt leaves while preserving fail-closed process, artifact, and recovery behavior
• move package-smoke artifact-delivery expectations to v0.7.9 while retaining baseline <=0.7.5 and matrix >=0.7.6 compatibility

Local validation

• canonical bun run check: green
• package: 211,421 packed bytes; 998,039 unpacked bytes; 56 files
• source tests: 334 passed, 0 failed
• Todo example: 25 passed, 0 failed; production and Direct boundary builds green
• React Native example: 29 passed, 0 failed; typecheck and iOS, Android, and web boundaries green
• npm dry pack and all seven published ESM entry imports: green
• dist/tooling/bombadil.js SHA-256: 2060e04b471692cf12b906ec453f1837c608ff346c2e22759e129d46cd7afe3a
• dist/tooling/browser-verification-entry.js SHA-256: 24c00c8430822f52852ffa070f82db7be4361c4527dc9876078ec50f144a61af

Delivery boundary

This pull request is intentionally draft. Auto-merge remains off pending independent review and exact-head required checks. Tagging, npm publication, and GitHub Release creation are separate immutable-release steps after merge.