npm hosted Step 25: packument generator

Pure-function library producing the three packument kinds (0 full, 1 dist-tags, 2 abbreviated) from npm_versions / npm_tags rows + a base URL -> bytes + SHA-256. No HTTP, no DB. Deterministic (modulo the omitted time field). Used by Step 11 (inline-build) and Step 12 (async rebuild).

Acceptance: AC 14/15 (unit halves: no synthesized latest), 16 (dist.tarball URL absolute); byte-identical output for identical inputs; abbreviated form = allow-listed fields only; zero versions -> { "name": "...", "versions": {} }. Files: packument.go + unit test. Depends on: Step 4.

Plan: Step 25. Spec: docs/specs/S11-npm-local.md.