chore: adopt node-addon-landlock-run source as native/ subtree

Bring the node-addon-landlock-run tree (tag v0.0.1, commit 614f7fd) into
native/landlock-run as its source of record: launcher development happens
here, next to the harness consumers, and the standalone repository becomes
the release mirror the tree is exported to for packing and publishing
(procedure in native/README.md). The subtree keeps its own pnpm workspace
and lockfile and is NOT added to the harness workspace: harness installs,
gates, and CI never touch it. The mirror's .github/ stays out of the
subtree; a separate manually-dispatched workflow
(.github/workflows/landlock-run.yml) runs the subtree's CI legs — the
per-architecture native builds, real-kernel launcher proofs, and pack
rehearsal — adapted with working-directory/cache paths.

eslint ignores the subtree like vendor/; AGENTS.md gains the native/
layout line (+5 words on its budget ceiling).

native/landlock-run/scripts/commit-release.mjs

@@ -0,0 +1,42 @@
+#!/usr/bin/env node
+/**
+ * Bump, stage, and commit a release in one command:
+ * `pnpm release:commit <major|minor|patch|x.y.z>`. The tag stays manual —
+ * create it from the merged release commit.
+ */
+
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { packageDirs, readJson, root } from './repo.mjs';
+
+const bump = process.argv[2];
+
+function run(command, args) {
+  const result = spawnSync(command, args, {
+    cwd: root,
+    stdio: 'inherit',
+    env: { ...process.env, CI: 'true' },
+  });
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    process.exit(result.status ?? 1);
+  }
+}
+
+if (!bump) {
+  console.error('Usage: pnpm release:commit <major|minor|patch|x.y.z>');
+  process.exit(1);
+}
+
+run('node', ['./scripts/bump-release.mjs', bump]);
+
+const version = readJson(path.join(root, packageDirs()[0], 'package.json')).version;
+run('git', [
+  'add',
+  'package.json',
+  'packages/*/package.json',
+  'pnpm-lock.yaml',
+]);
+run('git', ['commit', '-m', `release: ${version}`]);
+
+console.log(`Committed release ${version}. Create the tag manually: git tag v${version}`);