chore: adopt node-addon-landlock-run source as native/ subtree

Bring the node-addon-landlock-run tree (tag v0.0.1, commit 614f7fd) into
native/landlock-run as its source of record: launcher development happens
here, next to the harness consumers, and the standalone repository becomes
the release mirror the tree is exported to for packing and publishing
(procedure in native/README.md). The subtree keeps its own pnpm workspace
and lockfile and is NOT added to the harness workspace: harness installs,
gates, and CI never touch it. The mirror's .github/ stays out of the
subtree; a separate manually-dispatched workflow
(.github/workflows/landlock-run.yml) runs the subtree's CI legs — the
per-architecture native builds, real-kernel launcher proofs, and pack
rehearsal — adapted with working-directory/cache paths.

eslint ignores the subtree like vendor/; AGENTS.md gains the native/
layout line (+5 words on its budget ceiling).

native/landlock-run/scripts/github-matrix.mjs

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+/**
+ * Derive the GitHub Actions matrices from the checked-in package matrix
+ * (`packages/<name>/prebuilds.json`). Single source: adding a platform
+ * package extends CI and Release without editing a workflow.
+ *
+ *   node scripts/github-matrix.mjs ci                → one leg per distinct platform
+ *   node scripts/github-matrix.mjs release-prebuild  → one leg per platform package
+ */
+
+import path from 'node:path';
+import { platformDirs, readJson, root } from './repo.mjs';
+
+/** GitHub runner per prebuilds.json `platform` value — native builders only, no cross toolchain. */
+const RUNNERS = {
+  'linux-x64': 'ubuntu-24.04',
+  'linux-arm64': 'ubuntu-24.04-arm',
+};
+
+function runnerFor(platform) {
+  const runner = RUNNERS[platform];
+  if (!runner) {
+    throw new Error(`missing GitHub runner for platform: ${platform}`);
+  }
+  return runner;
+}
+
+function platformManifests() {
+  return platformDirs().map((dir) => ({
+    dir,
+    name: path.basename(dir),
+    prebuilds: readJson(path.join(root, dir, 'prebuilds.json')),
+  }));
+}
+
+function ciMatrix() {
+  const platforms = [...new Set(platformManifests().map(({ prebuilds }) => prebuilds.platform))].sort();
+  return {
+    include: platforms.map((platform) => ({ platform, runner: runnerFor(platform) })),
+  };
+}
+
+function releasePrebuildMatrix() {
+  return {
+    include: platformManifests().map(({ dir, name, prebuilds }) => ({
+      platform: prebuilds.platform,
+      package: name,
+      dir,
+      runner: runnerFor(prebuilds.platform),
+      artifact: `prebuild-${name}`,
+    })),
+  };
+}
+
+const target = process.argv[2];
+const matrices = {
+  ci: ciMatrix,
+  'release-prebuild': releasePrebuildMatrix,
+};
+
+if (!target || !matrices[target]) {
+  console.error(`Usage: node scripts/github-matrix.mjs <${Object.keys(matrices).join('|')}>`);
+  process.exit(1);
+}
+
+process.stdout.write(JSON.stringify(matrices[target]()));