mesh-build-node: run the type-check, the test script, tsc and esbuild in bubblewrap, so a change's code reaches no key, login or network (issue 1309, S1 S7 S8 S9, ADR 0448)

Each run step goes through mesh-sdk's buildstep.Isolated: no network, none of the account,
the workspace read-write, the toolchain read-only, the npm cache beneath a throwaway layer
unless the build step is told publish (a trunk build). The module declares the bubblewrap
package and refuses a step, unhealthy, while bwrap is missing or older than 0.10. The proof
test runs a probe script through the real test step.

modules/mesh-build-node/module.json

@@ -139,6 +139,11 @@
       "id": "openssh",
       "type": "package",
       "package": "openssh"
+    },
+    {
+      "id": "bubblewrap",
+      "type": "package",
+      "package": "bubblewrap"
     }
   ],
   "build": {