feat(artifacts): trace Mach-O dylib resolution in bundles

Add trace_dylib_resolution (CLI trace-dylib-resolution) to the artifact
family. For the active Mach-O, or every executable in the active .app
(the main app, XPC services, extensions, login items, helpers), it
reports which file each dylib load reaches and how.

A pure TypeScript reader decodes FAT and Mach-O load commands:
LC_LOAD/WEAK/REEXPORT/LAZY/UPWARD_DYLIB, including the newer
dylib_use_command encoding with weak, re-export, upward and delayed-init
flags, plus LC_ID_DYLIB, LC_RPATH, LC_DYLD_ENVIRONMENT and code-signature
presence. Malformed tables are reported with the failing command instead
of being guessed.

Resolution follows dyld:
- @executable_path comes from each process root;
- @loader_path comes from the loading image, or from the owner of the
  LC_RPATH entry being expanded;
- @rpath searches the loader's rpaths first, then up the load chain;
- dependencies load dependents-first in load-command order, once per
  process, and a matching install name reuses an already loaded image;
- symlinks are followed inside the analyzed root, and escapes stop.

Every candidate path is reported with its outcome. Each edge resolves to
resolved, conditional (an outside-root candidate such as /usr/lib/swift
precedes), unresolved, or undetermined. Absolute and shared-cache system
paths are never checked against the host. Derived findings cover
unresolved required or weak loads, absent earlier @rpath candidates (with
library validation left unknown), and LC_DYLD_ENVIRONMENT.

verify:macos-bundle now also:
- checks every traced image against otool -l;
- asserts each resolution status on a clang-built fixture that adds a
  missing Overrides rpath, an absolute rpath, and a delay-init library;
- compares the predicted load order of two process roots with what dyld
  loads under DYLD_PRINT_LIBRARIES.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/application/binary/BinarySession.ts

@@ -319,7 +319,8 @@ export class BinarySession
       lookupSnapshot: (target, profile, operation, parameters) =>
         operation === "decode_interface_builder" ||
         operation === "inspect_asset_catalog" ||
-        operation === "inspect_keyed_archive"
+        operation === "inspect_keyed_archive" ||
+        operation === "trace_dylib_resolution"
           ? undefined
           : this.lookupSnapshot(target, profile, operation, parameters),
     });
@@ -342,7 +343,8 @@ export class BinarySession
         profile !== undefined &&
         name !== "decode_interface_builder" &&
         name !== "inspect_asset_catalog" &&
-        name !== "inspect_keyed_archive"
+        name !== "inspect_keyed_archive" &&
+        name !== "trace_dylib_resolution"
       ) {
         const evidence = createEvidence(
           profiled.value.subject ?? active.target,