mesh-build-node: run the type-check, the test script, tsc and esbuild in bubblewrap, so a change's code reaches no key, login or network (issue 1309, S1 S7 S8 S9, ADR 0448)

Each run step goes through mesh-sdk's buildstep.Isolated: no network, none of the account,
the workspace read-write, the toolchain read-only, the npm cache beneath a throwaway layer
unless the build step is told publish (a trunk build). The module declares the bubblewrap
package and refuses a step, unhealthy, while bwrap is missing or older than 0.10. The proof
test runs a probe script through the real test step.

modules/mesh-build-node/cmd/mesh-build-node/main.go

@@ -51,6 +51,7 @@ func main() {
 		Run:                 forgekey.ExecRunnerClean(0),
 		Ctx:                 ctx,
 		Say:                 logf,
+		Bubblewrap:          ProbeBubblewrap,
 	}
 	// Outside a launch by the runtime — a build, a check — there is no node and no state to write.
 	if m.Node != "" {