feat(npm): full packument generation (S11 Step 25, part 2/3)

📦 What this MR does

Second of three stacked MRs delivering the S11 npm packument generator (Step 25), on top of the dist-tags slice (part 1). This part ships the full packument (kind=0):

• fullVersionFields — the per-version allow-list (the spec's "Allowed package.json fields", minus the reconstructed dist).
• buildVersions / buildVersionEntries / projectFields — parse each version's package_json once and project it through the full allow-list; the full entry carries the canonical npm _id (name@version).
• buildDist / tarballURL — reconstruct the dist envelope with the absolute tarball URL (AC 16); shasum / integrity are carried verbatim from the stored package_json.
• GeneratePackuments — builds the full + dist-tags kinds (Packuments{Full, DistTags}), reusing part 1's resolveDistTags. Fail-closed: an unparseable row aborts the whole build with an error naming the package/version/row.

The abbreviated kind (kind=2) and the build benchmark land in part 3.

✂️ Split change

This is a split change. Step 25 is delivered as three stacked MRs for reviewability; this MR targets part 1's branch:

• !557 dist-tags packument generation (part 1/3)
• !558 full packument generation (part 2/3) 👈
• !559 abbreviated packument generation (part 3/3)

🧪 Tests

Unit suite: full projection (every persisted field + the dist/integrity envelope), absolute tarball URL (AC 16, scoped + unscoped), zero-versions, denied/lifecycle-hook field drop, determinism, fail-closed parse errors, and dist-tags embedding into the full form.

📐 MR size

Above the 500-LOC reviewable ceiling. The production code is small; the bulk is the unit suite for a pure-function library that has no integration layer, so all verification is unit-level. Splitting tests from the code they pin is against project policy, and the full-projection machinery does not subdivide further.

Related to #143 (closed)