fix: polish source and symbol cleanup handling

[ianrayianray]

Summary

Follow-up cleanup for #13.

• Keeps a validated package replacement successful when stale backup cleanup fails, and returns a nonfatal warning in the result.
• Caps inflated SymbolReference.json data at the active runtime’s safe text limit.
• Applies the same bounded extraction to sampling profile data.
• Updates the package response schema, guidance, embedded skill, and deterministic regression coverage.
• Records on-prem dev/packages validation as an open evidence item because the local BC28 target was unavailable.

Validation

• bun test: 670 passed, 0 failed
• bun run typecheck: passed
• bun run build: passed
• Embedded-skill drift and git diff --check: passed

[SShadowS]

Reviewed, and I pushed one commit directly to this branch (42607da) rather than leaving it as review notes. Flagging that explicitly since it is your branch. Revert it if you would rather take it differently.

First, the review itself. Verified on 45b73b4: typecheck clean, build clean, zero embed-skills drift, bun test 670 pass / 0 fail across 46 files. All four items from the #13 review are closed properly:

• The backup-cleanup change does the right thing. A successful install now stays successful and reports a nonfatal warning, and the test forces EPERM on the first destination rename to actually reach the swap path before failing the backup removal. It then asserts the destination holds the new bytes and exactly one orphaned .backup remains. Those are real end-state assertions, not seam checks.
• MAX_TEXT_ENTRY_BYTES = buffer.constants.MAX_STRING_LENGTH with Math.min(512 MiB, ...) resolves to 536870888 and closes the 24-byte sliver where extraction could succeed only for toString() to fail. That was raised as academic; bounding it at the real runtime limit is better than the round number.
• Capping profile-tools.ts sampling extraction closes the follow-up, and asserting state.profile is released on that path is a good catch that was not asked for.
• Recording the on-prem dev/packages gap as an unchecked box with the reason, rather than quietly claiming it, is the right call.

What I changed in 42607da

1. Archive-read failures were typed as INTERNAL_ERROR.

extractEntry throwing zip entry exceeds the N-byte output limit matches none of fromKnownMessage's patterns, so it fell through to INTERNAL_ERROR, whose recovery step is "capture the redacted message and report it as a bc-dev-mcp issue". An oversized or malformed archive is server-returned data, so that sends the caller down the wrong path. The package path already wraps the same condition in protocolError(...); this brings bcdev_profile_finish in line via a small readArchive helper that preserves the original error as cause.

I applied it in two places, not one. The finding was about the newly capped extractEntry on the sampling path, but listEntryNames on the instrumentation path ten lines below has the identical defect, and fixing one while leaving the other would have been arbitrary.

2. Updated the test this changes. It asserted rejects.toThrow(/output limit/) against the raw message. It now asserts the typed shape (code, category, retryable) and confirms the original message survives on cause, which pins more than the previous version did.

3. README badge 668 to 670. This PR adds two tests and edits README, but not that line.

Verified on 42607da before pushing: 670 pass / 0 fail, typecheck clean, build clean, no drift. CI on the new head is green (verify and GitGuardian both success).

No other findings. Nothing here blocks merge.