feat: add signed global OSV bootstrap

[9batalion]

Summary

• stream and verify the pinned 813,101-record OSV ZIP into a staged compact SQLite snapshot
• add signed first-run global database bootstrap with descriptor-pinned verification/activation
• add bounded ZIP/ZIP64 preflight, disk/memory gates, completeness verifier, durable READY publication and deterministic release packaging

Evidence

• full suite: 1012 tests passed, 1 skipped
• focused global OSV/bootstrap suite: 20 tests passed
• independent security review: PASS (0 concerns, 0 logic errors)
• real OSV archive preflight: 813101 members; 62428599-byte central directory
• 10k real-record pilot: staged and independently verified
• repository self-scan: 0 findings

Boundaries

• snapshot profile is global-osv/full-osv-source, not Core/Full production coverage
• no KEV, EPSS or GHSA enrichment is claimed
• runtime scanning stays read-only after the explicit/first-run bootstrap
• release assets are not published by this PR; publication remains gated on the full build and remote readback