[codex] Finish multipart production hardening

[ubugeeei]

Summary

• Decode MIME quoted-pair boundary parameters while preserving the simple unlimited parse path.
• Add ParseLimits, limit errors, and regression coverage for part/header guardrails.
• Add Node and wasm binding smoke tests, plus a split bindings CI job with pnpm/corepack and wasm-bindgen setup.
• Add npm-compatible Node/wasm package templates and a tag-triggered binding artifact release workflow.
• Document parser limits, upload-safety guidance, binding artifacts, and JS field naming.

Closes #2
Closes #9
Closes #10
Closes #11
Closes #12

Local verification

• pnpm ci:local
• pnpm package:core
• pnpm package:bindings
• ruby -e 'require "yaml"; ARGV.each { |f| YAML.load_file(f); puts "ok #{f}" }' .github/workflows/ci.yml .github/workflows/release_core.yml .github/workflows/release_bindings.yml .github/dependabot.yml
• git diff --check
• node scripts/package-bindings.mjs --pack and inspected wasm tarball contents include generated JS glue.