Render caller-owned provider icon packs

[konojunya]

Summary

• add a pure, content-addressed provider-pack boundary with hash, SVG, rights, and size validation
• resolve namespaced provider icons without changing authored node semantics and return exact provenance notices
• expose capability-limited native and WebAssembly provider-pack operations, backed by shared fictional fixtures
• pin the final provider identifier specification/compiler revisions and release the engine API as 0.4.0

No vendor artwork is committed or distributed. Hosts retain filesystem, network, terms acceptance, and pack selection responsibilities.

Validation

• cargo +stable fmt --check
• cargo +stable test --workspace --locked
• formatter and engine conformance suites against specification 80df39151df67eedb4cfcb2de9f964129cd87466
• python3 scripts/validate-svg.py
• npm run build:wasm && npm test && npm run typecheck && npm run pack:check
• stable and Rust 1.85 Clippy with -D warnings
• rustdoc with -D warnings
• 95.33% regions, 95.87% functions, 97.52% lines