Cover the SHA-1 collision policy through the shim; bump componentize-js past its record-field reversal

[lann]

Fixes #184

Two co-dependent pieces — the check is red without the toolchain fix, and the toolchain bump alone is unobservable — so they land together.

The check

examples/componentize-demo gains sha1-collision-policy, the first JS-side exercise of mapWitError's extension branch and its known-pair table:

• honest input digests to standard SHA-1 in both postures (the FIPS 180-1 "abc" answer);
• attacked input (the SHAttered five-block prefix, shared verbatim with the Rust conformance probe) yields the deterministic sha1dc safe hash under the default mitigating posture;
• under setSha1CollisionPolicy("reject") the same input throws a DOMException named OperationError, with the ("lann:webcrypto", "collision-detected") pair asserted on the cause payload — the branchable identity per the error contract, message deliberately unpinned (human-only);
• the policy is restored in a finally, and an invalid policy name is a TypeError.

The bug the check caught (#184)

The cause-pair assertion failed against the pinned toolchain: componentize-js eed6d46 reverses record fields crossing the component boundary (push_record/pop_record traverse the value stack without the reversal the adjacent tuple paths apply), so origin and message arrived swapped and the known-pair lookup always fell through to the unknown-pair fallback. Invisible until now because extension-error is the package's only multi-field record, the bug self-cancels on pass-through, and no gate inspected the record's fields from JS. jco and the Rust targets are unaffected (verified against jco's generated glue and the cross-target conformance probe).

The bump

Upstream fixed it one commit past the pin (dicej/componentize-js bdd7c3d, "push and pop record fields in reverse order"). The rev bump takes exactly that single-file, two-line fix; the digest file records the new builds for both platforms, provenance-verified against this branch's toolchain workflow run.

Checks

• just test-webcrypto-componentize — 14 checks passed, including the new one with the strict pair assertion.
• just test-webcrypto-componentize-wpt — census unchanged, all in-subset tests passing under the new toolchain.
• just typecheck-componentize-sdk — clean.

The structural follow-up (the componentize path's only behavioral gate is not in CI) is #185.