* feat: add TypeScript schema library to npm wrapper package

Add pared-down TypeScript library to npm/socket-patch/ for use by
depscan. Includes schema validation (zod), git-compatible hashing,
manifest operations, recovery, and package-json postinstall helpers.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: normalize path separators in Go crawler PURLs on Windows

On Windows, `Path::strip_prefix` + `to_string_lossy()` produces
backslashes in the relative path, which get embedded in the PURL
(e.g., `pkg:golang/github.com\\gin-gonic\\gin@v1.9.1`). Replace
backslashes with forward slashes to produce correct PURLs on all
platforms.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: remove depscan-specific TS utilities, keep only schema

Move operational code (constants, hashing, manifest operations,
recovery, postinstall detection) back to depscan. Only the Zod
schema and its tests remain in the npm wrapper package.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The platform-specific binary packages and bin entry are only
needed for the published npm package, not for the workspace
submodule which is used solely as a schema library.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

When SOCKET_API_TOKEN is set to an empty string, the CLI should
fall back to the public proxy path (same as when the variable is
completely unset). Previously, `std::env::var().ok()` returned
`Some("")` for an empty-but-set variable, which passed the
`is_none()` check and sent the empty token to the authenticated
API endpoint, causing "Unauthorized" errors.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>