perf: verify documents in the preload with Web Crypto instead of JS SHA-256

[lidonggui]

What

The preload still verifies every document it receives against the envelope hash. The integrity check is unchanged; what changed is how the hash is computed.

• The validators are synchronous, the sandboxed preload has no node:crypto, and Web Crypto only answers with a promise. So the check used to run a plain-JS SHA-256 on the renderer thread.
• New collectDigestClaims(run) runs any validator with the envelope-hash checks collected instead of computed. Every other check runs as before.
• New verifyDigestClaims(claims) then checks each claim with crypto.subtle.digest('SHA-256'), falling back to the portable sha256Hex if Web Crypto is missing. A payload passes only if the validator passes and every claim verifies, which is the same verdict as the synchronous path. No document validator branches on the hash result: unions are discriminated by status / exact keys, so collecting can't change which branch accepts.
• Outside collectDigestClaims, isNotoDocumentWire still hashes synchronously. Tests and any other caller are unchanged.
• In the preload, invoke, invokeFileTruth, invokeWorkspace and subscribe hand payloads on through one arrival-ordered chain. A later event is never delivered before an earlier document, whether or not it carries one itself.

Measured (huge 8 MB, packaged, Linux box, interleaved with f25d1fe)

	before	after
preload document check on the renderer thread (profiled)	~258 ms (compressSha256Block ~201)	~52 ms (UTF-8 encode + structure; the digest runs off-thread, ~9 ms to await)
profiled open	1,721 / 1,758 ms	1,605 / 1,514 ms
bench open huge, BENCH_RUNS=5	1,623 / 1,673 ms	1,522 / 1,465 ms
bench open large	661 / 658 ms	590 / 587 ms

Tests

• New preload-native-digest.test.ts:
  • The Web Crypto digest equals the JS SHA-256 (and node:crypto) on empty input, every padding boundary (55–128 bytes), CJK + emoji + lone-surrogate text, a BOM, and 3 MB of random bytes.
  • Collected claims accept a genuine wire and refuse a same-length forged text, with and without the native digest, matching the sync verdict.
  • The BOM is restored before hashing.
  • Collection is scoped to the call.
• pnpm typecheck and pnpm test pass.