refactor(sdk): split native SDKs and share golden harness

[samzong]

Summary

The SDK entry files mixed bundle loading, host selection, filesystem ownership, and CLI interaction, while four golden runners repeated fixture setup and assertions. Split the native implementations by responsibility, centralize ownership and write paths within each SDK, and move shared golden setup and assertions into one Node harness with native SDK adapters.

The public package APIs, all 89 golden cases, host data, and schemas remain unchanged. The published Go, Rust, and Python packages remain native and do not depend on Node; repository golden tests now require Node.js 24.

Size and structure

Physical lines, including blank lines, measured against 6dc6e489f119fa63101c23781ddcd6992bffadc8:

Scope	Before	After	Reduction
All tracked files	24,674	22,189	2,485 / 10.1%
Source, tests, and build scripts	14,932	12,433	2,499 / 16.7%

The source subset includes .ts, .mjs, .go, .rs, .py, .sh, .yml, .yaml, and Makefile. New modules are included in both totals. The Rust, TypeScript, and Go entry files were 2,244, 1,990, and 1,933 lines; the largest SDK source file is now 468 lines.

This draft does not satisfy the 30% overall reduction target.

Verification

• node scripts/check.mjs (the make check entry point).
• node scripts/check.mjs: passed spec and generated-data checks, all four native golden adapters, formatting, linting, builds, native tests, standalone Go modules, and all four examples.
• Python tests on 3.10 and 3.14: 42 passed on each; package-root exports and public function signatures match the baseline.
• npm tarball consumer, Rust package verification, standalone Go/Cobra consumer, and Python wheel lifecycle smoke checks passed locally. Rust source tests pass with and without include-dir.
• The original golden case data and schemas are byte-for-byte unchanged. Shared assertions cover reports, selection, workflow output, filesystem presence, modes, metadata, and target write counts.

The shared hash oracle exposes an existing difference: TypeScript sorts bundle paths with localeCompare; Go, Rust, and Python sort lexically. This refactor preserves those persisted hashes and explicitly documents the limitation. It does not claim cross-language hash equality or introduce a hash migration.

Scope Check

• Stays within the v0.1 bundled-skill installer boundary.
• Does not add marketplace, registry, private remote install, script execution, GUI, MCP server, or agent runtime behavior.
• Golden cases remain unchanged because no observable installer behavior change is intended.
• Host constants remain unchanged; spec/hosts.json is unchanged and generation checks pass.