Mitigate Supabase Edge cache crashes in the SDK fixture

[kvz]

Why

Main's Supabase fixture intermittently exits 135 before producing a bundle. Native
crash dumps and a no-SDK CommonJS reproduction identify a Supabase/Deno SQLite
cache-initialization race, not SDK bloat. Reported upstream as
supabase/edge-runtime#746.

Changes

• Mount a fresh, bounded 256 MiB tmpfs for the bundler's Deno cache. This is a
  fixture-only mitigation; the pinned runtime and published packages are unchanged.
• Keep fresh installs including optional dependencies, both SDK package names,
  native-dependency rejection, raw/compressed size budgets, real HTTP execution,
  HMAC verification, crash evidence and cleanup. No retries or warm/shared caches.
• Add a red-first Docker invocation contract test and document the mitigation.

The diagnostic-only edge-crash branch is not included and must never be merged.
No Changeset, release, deployment, new dependency or normal CI workflow change.

Validation

• Earlier native x64 diagnosis: 6/90 crashes without any SDK; 90/90 SDK bundles
  passed with the isolated tmpfs. This is mitigation evidence, not an upstream fix.
• Local full packed fixture passes for both names, with zero native image paths:
  Node 28,025,947 raw / 2,454,583 upload bytes; legacy 28,025,764 / 2,459,280 bytes.
• Negative control: published 4.13.0 is still rejected for its 77 native image
  paths (47.6 MB raw / 10.2 MB compressed), with the mitigation enabled.
• Council's one P2 addressed: preserve the Docker image boundary in the regression
  assertion. The old test misses the deliberately misplaced image; the corrected
  test rejects that mutant and passes with the valid invocation restored.
• yarn check and post-review yarn verify:full pass.
• All checks passed again in run 35829346787
  on final head a04cb6fa2e9aa547b0a813887cc93d75a9f41b5c, including the real x64
  Edge fixture, packed Next browser tests, release dry run, and Node 20/22/24.
  The preceding run 35828672200
  also passed in full before the documentation-only evidence commit.

Fixes #510.