feat: prepare reviewed Oh adoption candidates

[0thernet]

Summary

• add an immutable, host-policy-bound adapter for preparing reviewed Oh dependency-closure adoption candidates
• keep Markdown and Git as KB authority; the adapter has no write, purge, filesystem, or repository capability
• pin the released Oh v0.2.0 API and harden all reviewer-visible disclosures against terminal and bidirectional control spoofing
• stage package metadata for v0.18.0

Verification

• bun run check (1,204 tests, 12,323 assertions)
• focused adversarial adoption suite (8 tests, 216 assertions)
• canonical package identity and historical recovery smokes

Release

Merge stages v0.18.0 through the repository OIDC workflow. Final npm approval remains the documented two-factor human terminal step.