feat(js): add typed browser file capabilities

[GG-O-BP]

Summary

• add glendix/js/file with a Gossamer-backed declarative download resource and explicit object-URL cleanup
• add a Plinth-backed modern file picker with typed capability, cancellation, selection, metadata, size, type, open, and read errors
• expose stable case-insensitive accepted-type de-duplication for a visible Lustre/Redraw fallback while intentionally avoiding hidden-input/click FFI
• document the package capability matrix and the single residual picker-capability predicate
• add contract coverage for success, cleanup, unsupported/cancelled/error paths, empty and exact/overflow boundaries, type matching, read failure, and first-handle ordering

Verification

Passed:

• gleam format --check
• gleam check
• gleam build --warnings-as-errors
• gleam docs build
• gleam test --runtime bun (108 tests)
• ./scripts/verify.sh inner glendix
• scripts/check-style.py through the shared gate
• scripts/check-ffi-contracts.py through the shared gate (331 declarations)
• real-browser check with local Glendam + committed Chrome: declarative Blob download produced the expected file, CDP-backed visible file selection read the expected bytes, and picker_capability reported available
• ./scripts/dependency-mode.sh check-commit glendix 832ef0382e8898aabbd357362d75b83e1aa52b04

The first clean ./scripts/verify.sh shared glendix run reached standalone-consumer verification after all source/style/FFI/generator gates, then Hex returned its API rate-limit error. This is an environment/service failure rather than a source failure; the gate will be rerun before merge.

Closes #8

[GG-O-BP]

Post-merge independent acceptance audit completed on 2026-09-07.

I re-derived issue #8's requirements and checked the merged implementation against each path: declarative Gossamer-backed download creation and repeated cleanup, invalid filename/concrete MIME rejection, stable case-insensitive accept de-duplication, positive maximum-size validation, explicit modern-picker capability/fallback policy, unsupported/cancelled/selection/open/read failures, empty files, exact-limit acceptance, overflow rejection before reading, MIME wildcard/extension checks, and first-handle ordering. No missing source handling was found.

The complete family gate now also passes:

./scripts/verify.sh final
FINAL_GATE_EXIT=0

This includes source/style/FFI/generator gates, standalone consumers, all core tests, the fixture MPK build, Lustre browser E2E, and Mendix 11.12.0 build/runtime browser E2E. The validation worktree's stale harness/widget-test-app/manifest.toml and harness/lustre-test-app/manifest.toml locks were refreshed transiently to match the local Glendix 6.0.0 and Mendraw 2.1.0 path packages; no harness changes were committed.