[wieslawsoltes]

Problem

A single-architecture package can contain universal native inputs such as kerberos.node. The recursive final-bundle audit correctly rejects the unused slice, so packaging needs to normalize the bundle before audit and signing.

Change

• recursively preflight every Mach-O and atomically thin universal inputs when exactly one package architecture is requested
• preserve mode, owner, and mtime; reject missing slices, hard links, mutation, malformed or growing output; clean temporary files on every failure
• audit the normalized graph before nested signing, sign every discovered Mach-O, then audit again for bounded schema-v2 evidence before outer signing
• keep multi-architecture packaging unchanged
• add deterministic portable fixtures and a 10,000-entry time/FD/RSS/temp/evidence gate
• make the installed SDK consumer build a real universal .node, package it, verify signatures/evidence, and load its selected slice

Validation

• python3 eng/sdk/test-macos-bundle-audit.py (21 tests)
• python3 eng/sdk/test-installed-macos-bundle-audit.py
• python3 -m py_compile ...
• JSON schema parse and git diff --check

Fixes #344