fix(crosscheck): certify Jest and Vitest mutations

[ruby-dlee]

Summary

• add measured Jest 29.7.0 and Vitest 4.1.5 mutation-certification policies
• require authenticated selected-test body execution before JavaScript results can clear a finding
• harden Jest and Vitest runtime, worker, configuration, environment, and spawn trust boundaries
• preserve current main reviewer-account, legacy-admission, behavior-suite, and merge-queue changes during rebase
• seal the checkout identity cost test and reconcile certification fixtures with the current behavior runner

Verification

• FM_TEST_FOCUSED=javascript-body-proof tests/fm-crosscheck.test.sh
• FM_TEST_FOCUSED=review-safety-findings tests/fm-crosscheck.test.sh
• tests/fm-checkout-identity-cost.test.sh
• bin/fm-lint.sh
• python3 tests/test-seal.py verify