fix(iroha_js): fit hardened Torii client within bundle cap

[takemiyamakoto]

Summary

• deduplicate the four SoraFS reputation request/parsing paths without changing public API arity or return-key order
• capture validation intrinsics to resist application monkey-patching
• preserve strict own-field, u64, proof-geometry, request-binding, retry, redirect, signal, and response-bound semantics
• add hostile intrinsic/prototype and fail-fast precedence regression coverage

Exact candidate

• commit: 555b2bc06cee90c3375a448bff8d0af8153af3b8
• tree: 6df598cfcd5baab82379bac1455dd739ed4cf47d
• Torii bundle: 989,667 bytes under the unchanged 992,256-byte cap (2,589 bytes headroom)
• deterministic package SHA-256: c348ef05c4fc46e52c0f61060cf3f938a69a83cd3e8d3562ec8b5bc23179609b

Verification

• npm run bundle:check passed all seven caps and explicit browser export audits
• focused positive/adversarial suite: 7/7 passed
• SoraFS hedging/billing suite: 5/5 passed
• Torii source suite: 755/762; the seven failures are the expected unavailable-native-binding cases
• npm run lint, npm run build:dist, npm run check:changelog, npm run test:pack-install, and npm audit --omit=dev passed
• two package runs were byte-identical
• independent diff review found no actionable issue

Upstream baseline limitation

A native-backed run cannot be completed at this exact base: after working around the stale unmapped iroha-docs gitlink, absent ignored lockfile, and stable Cargo -Z lockfile-path rejection, exact-base Rust fails in crates/iroha_core/src/state.rs:30704 with E0609 because State has no telemetry field. The workaround was reverted and no generated build files are included. Distribution testing completed with 2,010 passing tests; the other failures are missing-native or existing exact-base golden/fixture mismatches, not failures introduced by this two-file diff.