Add hermetic policy bootstrap

[longlho]

What

• load a versioned hermetic policy from a CLI-only inherited fd before dotenv/config startup I/O
• validate logical cwd, execPath, mounts, and live backing fds, then keep the policy immutable process-wide
• use Node's option parser boundary so script args cannot enable hermetic mode
• wire the downstream patch and generated source inventory into rules_nodejs

Test plan

• git apply --check nodejs/private/patches/nodejs/hermetic-policy-bootstrap.patch against Node v26.3.1
• compiled src/node_hermetic_policy.cc in a Node v26.3.1 build
• added focused upstream CLI coverage for valid/invalid manifests, dead policy and mount fds, CLI source enforcement, script args, and startup ordering

Full focused runtime execution is left to CI; the local Node build config regenerated mid-validation and invalidated the minimal build graph.