fix(s9pk): normalize JavaScript ingredient permissions

[BeeJoe]

Summary

• Normalize permissions while creating the v2 JavaScript SquashFS, adding read access to files and read/search access to directories (ugo+rX) without mutating the source tree or stripping executable bits.
• Cover the production wiring through public pack(): the regression re-executes under umask 077, builds a real .s9pk, extracts javascript.squashfs, and verifies both archive and source modes.
• Run the canonical start-core suite in a derived builder image containing Node.js and SquashFS tools.
• Document the packaging guarantee for StartOS, start-cli, the SDK packaging guide, and the s9pk format; add the required StartOS 0.4.0.2 and start-cli 1.1.1 changelog/version/generated-man-page coupling.
• Complete the start-core CONTRIBUTING.md → AGENTS.md migration without duplicating root-owned prerequisites.

Previously, a restrictive packager umask could embed 0700 JavaScript directories and a 0600 index.js, causing StartOS to report /usr/lib/startos/package/index.js not found for an otherwise valid package.

Supersedes #3587.

Verification

• make start-core-test: 257 passed, 0 failed, 3 ignored
• Focused real-package regression: 1 passed
• cargo check -p start-os -p start-core
• cargo check --tests -p start-core --features=test
• make manpages: 4 passed
• mdbook build in projects/start-os/docs
• Rust formatting, Prettier, shell syntax, and diff-hygiene checks