Extend binary symbol scanning to npm native addons (.node files)

[lachaib]

Summary

• Add .node to the compiled-binary extension set and add extractTarballBinaries() to pull raw binary buffers out of an already-extracted npm tarball, mirroring the existing wheel/zip path.
• Move binary-scan.ts/binary-formats.ts from ecosystems/python/ to ecosystems/shared/, since the ELF/Mach-O/PE parsing was already ecosystem-agnostic and is now consumed by three ecosystems, not one.
• Wire scanBinary/binaryFindingsDelta into the npm tarball scan path in javascript/index.ts and the npm-compat path in deno/index.ts, so native addons (better-sqlite3, bcrypt, sharp, etc.) get the same symbol-table/suspicious-string/entropy checks Python wheels already get. JSR packages are untouched — they can't ship native binaries.
• Fix a real gap surfaced by the new tests: the shared directory-walk skip list excludes build/, which is exactly where node-gyp writes build/Release/*.node. Binary walking now uses its own minimal skip list (.git, node_modules) instead of the text-scan one, so real-world native addons aren't silently missed.

Closes #6

Test plan

• pnpm run typecheck
• pnpm run check (biome lint/format — 0 errors)
• pnpm test (58 tests passing, including new coverage for extractTarballBinaries/.node zip entries and the build/Release skip-dir regression)