Fix cross-target bundled CLI startup

[chubes4]

Summary

• defer loading Sharp until visual comparison actually normalizes animated media
• prove extracted release CLIs can run --version and commands with native Sharp packages unavailable
• canonicalize provenance source paths so macOS /var and /private/var aliases hash identically

Refs #1250.

Testing

Passed:

• npm run build
• npm run test:cli-build-freshness
• npm run test:release-target
• npm run test:sharp-release-runtime
• npm run test:prepare-declaration-rebuild
• npm run test:release-package-coverage (initial complete run)

The full package smoke reaches an unrelated existing failure in native-mariadb-runtime-service.test.ts: the loopback collision fixture allocates once instead of twice (1 !== 2). A repeated 430+ MB release-package run later timed out after the initial successful run.

AI Assistance

OpenAI gpt-5.6-sol through OpenCode reproduced the packaged CLI failure, implemented the lazy native dependency boundary and macOS provenance normalization, and ran the listed verification. Chris Huber reviewed and remains responsible for the change.