feat(npm): abbreviated packument generation (S11 Step 25, part 3/3)

📦 What this MR does

Third of three stacked MRs delivering the S11 npm packument generator (Step 25), on top of the full-packument slice (part 2). This part ships the abbreviated packument (kind=2) — the install-only projection served for Accept: application/vnd.npm.install-v1+json:

• abbreviatedVersionFields — the per-version install allow-list (a strict subset of the full field set).
• Refactors buildVersionEntries to parse each version's package_json once and project it through both the full and the abbreviated allow-lists in a single pass, and populates Packuments.Abbreviated.
• Folds in the S11 spec amendment aligning the abbreviated allow-list with the generator: modified is dropped from the abbreviated top-level allow-list and the determinism carve-out is extended to cover it (the generator has no timestamp input; the GitLab monolith reference emits neither time nor modified).

✂️ Split change

This is a split change. Step 25 is delivered as three stacked MRs for reviewability; this MR targets part 2's branch and completes the generator:

• !557 dist-tags packument generation (part 1/3)
• !558 full packument generation (part 2/3)
• !559 abbreviated packument generation (part 3/3) 👈

🧪 Tests

Unit suite: abbreviated allow-list, strict-subset-of-full, determinism across tag order (property test via rapid), distinct CAS digests across all three kinds, and a build benchmark over 1k / 25k versions including a near-20 KB-package_json worst case (documents the cold-miss memory footprint the Step 11 handler must budget singleflight + a request deadline against).

📐 MR size

Above the 500-LOC reviewable ceiling. The production delta is small (abbreviated allow-list + the parse-once refactor); the bulk is the unit suite for a pure-function library with no integration layer. Splitting tests from the code they pin is against project policy.

Related to #143 (closed)