Harden Bombadil download provenance

[0thernet]

Summary

• bind Chrome partial-download provenance to an exact lowercase UUID and filesystem identity during live Bombadil artifact monitoring
• accept only the same-UUID, same-inode partial-to-complete rename while keeping stopped, hashed, receipt, and public inventories strict
• retain the package-size guard with a synchronized 1,030,000-byte unpacked ceiling for the reviewed artifact

Validation

• focused npm release/package suite: 17/17 passed
• canonical bun run check: passed under Bun 1.3.14, Node 24, and isolated npm 11.19.0
• 350 source tests and both examples passed
• package: 59 files, 1,020,604 unpacked bytes (9,396 bytes below ceiling)
• git diff --check: clean

This remains draft until exact-head CI and independent review are terminal. A monotonic patch release will be prepared only after the reviewed source is current and ready.