chore: adopt node-addon-landlock-run source as native/ subtree

Bring the node-addon-landlock-run tree (tag v0.0.1, commit 614f7fd) into
native/landlock-run as its source of record: launcher development happens
here, next to the harness consumers, and the standalone repository becomes
the release mirror the tree is exported to for packing and publishing
(procedure in native/README.md). The subtree keeps its own pnpm workspace
and lockfile and is NOT added to the harness workspace: harness installs,
gates, and CI never touch it. The mirror's .github/ stays out of the
subtree; a separate manually-dispatched workflow
(.github/workflows/landlock-run.yml) runs the subtree's CI legs — the
per-architecture native builds, real-kernel launcher proofs, and pack
rehearsal — adapted with working-directory/cache paths.

eslint ignores the subtree like vendor/; AGENTS.md gains the native/
layout line (+5 words on its budget ceiling).

native/landlock-run/scripts/verify-launcher-binary.mjs

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+/**
+ * Prepack gate for platform packages: refuse to pack a tarball whose
+ * declared binaries are missing or built for the wrong architecture.
+ *
+ * Without it, `pnpm pack` on a checkout that never ran
+ * `pnpm run build:native` would ship an EMPTY platform package — the
+ * binary's absence surfacing only at runtime as a failed probe on every
+ * consumer — and a binary copied across packages would advertise an
+ * architecture it cannot execute. The check is presence + ELF `e_machine`
+ * against the package's declared `cpu`; byte provenance is
+ * `verify-packed-install.mjs`'s concern (it pins the installed tarball
+ * against the workspace build).
+ *
+ * Runs from each platform package's `prepack` hook (pnpm sets the script
+ * cwd to the package directory). Also callable directly with an explicit
+ * package directory: `node scripts/verify-launcher-binary.mjs packages/<name>`.
+ */
+
+import path from 'node:path';
+import { root, verifyPlatformBinaries } from './repo.mjs';
+
+const packageDir = process.argv[2] ? path.resolve(root, process.argv[2]) : process.cwd();
+
+try {
+  const { name, count } = verifyPlatformBinaries(packageDir);
+  console.log(`verify-launcher-binary: ${name} — ${count} binaries present with the right ELF architecture.`);
+} catch (error) {
+  console.error(`verify-launcher-binary: ${error instanceof Error ? error.message : error}`);
+  process.exit(1);
+}