Move the sealed box into the SDK, so the vault and providers need not copy it (issue 650)

go/seal and its TypeScript twin @novox/mesh-sdk/seal are the ADR 0206 box
the licence manager kept to itself. Fixtures made by the licence manager's
own seal.go prove both byte for byte, in both directions. (Replaces the
placeholder README the branch's first commit carried by mistake.)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

package.json

@@ -1,29 +1 @@
-{
-  "name": "@novox/mesh-sdk",
-  "version": "0.1.14",
-  "description": "The stable spine a Novox Mesh module's own code builds against.",
-  "type": "module",
-  "exports": {
-    ".": "./dist/index.js",
-    "./contracts": "./dist/contracts/index.js",
-    "./provisioner": "./dist/provisioner/index.js",
-    "./tools": "./dist/tools/index.js",
-    "./messaging": "./dist/messaging/index.js",
-    "./events": "./dist/events/index.js",
-    "./primitives": "./dist/primitives/index.js",
-    "./stdio": "./dist/stdio/index.js",
-    "./state": "./dist/state/index.js"
-  },
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "build": "tsc",
-    "test": "node --test --experimental-strip-types 'test/*.test.ts'",
-    "prepare": "tsc"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "typescript": "^5.6.0"
-  }
-}
+PKGJSON