Add MFE verified bake orchestrator

What does this MR do and why?

Adds the verified bake orchestrator — the heart of the registry-direct micro-frontend (MFE) delivery series (see below for the full picture).

Gitlab::Mfe::Baker turns the pins from vendor/mfe.yml into static release assets, working against the real registry contract (demo registry: https://gitlab-mfe-registry-demo.storage.googleapis.com):

• Fetches each pinned app's version manifest and verifies the pinned SHA256 over the raw manifest bytes before parsing.
• Downloads the version's assets.zip in a single request, verifies the archive bytes against the manifest's declared SHA256 before opening, then extracts with zip-slip, symlink, duplicate-entry, and decompression-budget guards, re-verifying every file's declared size and SHA256 in memory before a single byte reaches disk.
• Commits each app atomically (staging directory + rename swap with rollback on failure) and writes the baked manifest last; one bad byte aborts the whole bake with nothing written.
• Pinned-origin policy: asset and archive URLs are always constructed from the configured registry origin; manifest-supplied base_url and archive.url are deliberately ignored, so a manifest cannot redirect a bake elsewhere.
• No database access anywhere on this path — it runs alongside asset compilation.

The building blocks it orchestrates (VendorFile, RegistryManifest, BakedManifest) are reviewed in parts 1–3 of the stack below. Nothing invokes the baker yet — dead code until the final MR lands.

The series

GitLab-hosted micro-frontend apps are pinned to exact versions and baked into release assets after byte-level verification against the MFE registry. The work is split into five small stacked MRs, merged bottom-up:

#	MR	Content
1	!249067 (merged)	Vendor pin file and reader
2	!249068 (closed)	Registry version manifest contract
3	!249069 (closed)	Baked manifest writer/reader
4	!249070 (closed)	Verified bake orchestrator (this MR)
5	!249071 (closed)	Rake task and asset-compile wiring (the integration flip)

Related to #605798 (closed) (MFE Phase 1: verified delivery foundation).

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist.