[codex] Expose neutral QTI package parser

[ottenhoff]

What changed

Closes #18.

• Added a framework-neutral parseQtiPackage API in qti3-core for reading QTI package ZIP bytes into typed package, manifest, item, asset, timing, and standard-alignment models.
• Added a zero-third-party-runtime ZIP reader path with caller-supplied raw DEFLATE inflation so core can parse stored packages by default and deflated packages when hosts provide inflation.
• Split package parsing across focused core modules for ZIP reading, XML parsing, manifest extraction, item/test materialization, metadata, assets, and path/diagnostic helpers.
• Added package parser coverage and public API export assertions.

Impact

Consumers can now inspect QTI packages server-side or browser-side without binding to a player, DOM renderer, or framework adapter. Normal package failures are surfaced as structured diagnostics rather than silent fallbacks.

Validation

• CI=true pnpm verify
• Focused package parser and public API tests
• Typecheck and raw lint