chore: adopt node-addon-landlock-run source as native/ subtree

Bring the node-addon-landlock-run tree (tag v0.0.1, commit 614f7fd) into
native/landlock-run as its source of record: launcher development happens
here, next to the harness consumers, and the standalone repository becomes
the release mirror the tree is exported to for packing and publishing
(procedure in native/README.md). The subtree keeps its own pnpm workspace
and lockfile and is NOT added to the harness workspace: harness installs,
gates, and CI never touch it. The mirror's .github/ stays out of the
subtree; a separate manually-dispatched workflow
(.github/workflows/landlock-run.yml) runs the subtree's CI legs — the
per-architecture native builds, real-kernel launcher proofs, and pack
rehearsal — adapted with working-directory/cache paths.

eslint ignores the subtree like vendor/; AGENTS.md gains the native/
layout line (+5 words on its budget ceiling).

native/landlock-run/scripts/verify-release.mjs

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+/**
+ * Release verification. Always: every published package carries one shared
+ * version, and — when running from a tag or publishing — the `vX.Y.Z` tag
+ * matches it. With `--prebuilds`: every platform package's declared
+ * binaries exist with the right ELF architecture (run after
+ * `assemble-prebuilds.mjs` or a local `build:native`).
+ */
+
+import path from 'node:path';
+import { packageDirs, platformDirs, readJson, root, verifyPlatformBinaries } from './repo.mjs';
+
+function verifyVersions() {
+  const packages = packageDirs().map((dir) => ({
+    dir,
+    manifest: readJson(path.join(root, dir, 'package.json')),
+  }));
+  const versions = new Set(packages.map((pkg) => pkg.manifest.version));
+  if (versions.size !== 1) {
+    throw new Error([
+      'published package versions must match:',
+      ...packages.map((pkg) => `${pkg.dir}: ${pkg.manifest.version}`),
+    ].join('\n'));
+  }
+
+  const version = packages[0].manifest.version;
+  const ref = process.env.GITHUB_REF || '';
+  const publish = process.env.RELEASE_PUBLISH === 'true';
+  if (publish && !ref.startsWith('refs/tags/v')) {
+    throw new Error('publishing requires running the workflow from a v* tag');
+  }
+  if (ref.startsWith('refs/tags/v')) {
+    const tagVersion = ref.slice('refs/tags/v'.length);
+    if (tagVersion !== version) {
+      throw new Error(`tag/version mismatch: tag v${tagVersion}, packages ${version}`);
+    }
+  }
+
+  console.log(`Verified release version ${version}`);
+}
+
+function verifyPrebuilds() {
+  for (const dir of platformDirs()) {
+    const { name, count } = verifyPlatformBinaries(path.join(root, dir));
+    console.log(`Verified ${name}: ${count} binaries`);
+  }
+}
+
+verifyVersions();
+if (process.argv.includes('--prebuilds')) {
+  verifyPrebuilds();
+}