fix(s9pk): normalize JavaScript ingredient permissions

[BeeJoe]

Summary

• Normalize permissions while creating the v2 JavaScript SquashFS, adding read access to files and read/search access to directories (ugo+rX) without mutating the source tree or stripping executable bits.
• Cover the production wiring through public pack(): the regression re-executes under umask 077, builds a real .s9pk, extracts javascript.squashfs, and verifies both archive and source modes.
• Run the canonical start-core suite in a derived builder image containing Node.js and SquashFS tools.
• Document the packaging guarantee for StartOS, start-cli, the SDK packaging guide, and the s9pk format.
• Complete the start-core CONTRIBUTING.md to AGENTS.md migration without duplicating root-owned prerequisites.

Previously, a restrictive packager umask could embed 0700 JavaScript directories and a 0600 index.js, causing StartOS to report /usr/lib/startos/package/index.js not found for an otherwise valid package.

Supersedes #3587.

Master merge and conflict resolution

Merged current Start9Labs/master at 6a1f75d6c in 8f501afb5.

• Resolved projects/start-cli/CHANGELOG.md by retaining the authcookie fix already on master and adding the s9pk permission fix under the existing unreleased 1.1.1 heading.
• Resolved projects/start-os/CHANGELOG.md by retaining all current 0.4.0.2 entries, including the notification fix from fix(ui): align mobile notification checkboxes #3616, and adding the s9pk permission fix.
• Dropped the duplicated 0.4.0.2 manifest, migration, lockfile, release-link, and generated man-page changes now supplied by fix(ui): align mobile notification checkboxes #3616. Those files are byte-identical to master in the effective PR diff.
• Retained the version comment generalization because master now uses 0.4.0.2 while the old comment named 0.4.0.1 specifically.

Verification

Original branch verification before the master merge:

• make start-core-test: 257 passed, 0 failed, 3 ignored
• Focused real-package regression: 1 passed
• cargo check -p start-os -p start-core
• cargo check --tests -p start-core --features=test
• make manpages: 4 passed
• mdbook build in projects/start-os/docs
• Rust formatting, Prettier, shell syntax, and diff-hygiene checks

Post-merge verification on 8f501afb5:

• cargo check --tests -p start-core --features=test
• cargo check -p start-os -p start-core
• cargo fmt --all --check
• Prettier over every changed Markdown file
• mdbook build in projects/start-os/docs
• mdbook build in projects/start-sdk/docs
• Shell syntax checks for build/builder-alias.sh and shared-libs/crates/start-core/run-tests.sh
• git diff upstream/master --check
• No unresolved index entries

The post-merge focused runtime rerun was stopped while still compiling the repository test binary under the optimized test profile; it produced no test failure and never reached the harness. The test target typechecks on the merged tree, and the unchanged focused regression passed before the merge.