refactor(plugin): add Python-free Unix OS primitives

[kmbroai]

Summary

Add the Unix OS primitives needed to replace Python filesystem, locking, and account-lookup helpers with TypeScript callers.

Changes

• Add nine Node-API 8 bindings for descriptor-relative operations, metadata, raw link targets, locking, and named-user home lookup. TypeScript owns caller behavior.
• Compile the typed build and proof tools through the existing TypeScript build. Build with Cargo, without Python or node-gyp.
• Add Linux and macOS x64/arm64 artifact jobs with Node 20.0 and 22.13 proofs, compatibility-floor checks, and build-path remapping. Use a relative macOS install name so linker metadata does not embed the build directory.

Testing

• On the rebased head: TypeScript compilation, SDK/MCP types, formatting, Rust formatting, Ruff, portable source checks, and all nine checker tests passed.
• Fresh Linux builds and native behavioral proofs passed on Node 20.0 and 22.13, including Python lock interoperability during independent review.
• The original implementation is unchanged by the rebase. Earlier platform and full SDK validation is recorded in the PR history; fresh hosted jobs will verify this head.
• Local workstation builds do not establish the glibc 2.28 compatibility floor. The hosted manylinux and macOS jobs remain required.

Risk and rollout

Stacked on #792. This foundation is opt-in preparation. Windows bindings and universal package assembly follow before product commands use the native payloads. Hosted macOS and arm64 execution remain required validation.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-03T19:08:16.149864Z	2b6e432	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

Reviewed c959dd3. I found no actionable code issues in the Unix bridge, and all four native Linux/macOS jobs pass.

Holding approval for the Windows package verification timeout. The package installation in smoke-package.mjs hits the 180-second timeout. Please rerun that job on this head; if it repeats, investigate the install timeout. The current log does not tie it to the native implementation.

Nonblocking: the native workflow runs all four build jobs for root README-only changes. Please preserve the existing documentation-only CI fast path; the Windows and musl workflows added later in the stack have the same issue.

[mldangelo-oai]

The Windows package verification rerun passed on the unchanged reviewed head, clearing my earlier hold. All four native Linux/macOS jobs also pass. No actionable code findings; the documentation-only CI suggestion remains nonblocking.