feat(bundle): emit bundle v2 next to v1 (RFC-070 F1)

[0xmanhnv]

Emits bundle format v2 (signed pointer, signed manifests, content-addressed gzip JSONL chunks keyed by record-id ranges) alongside the unchanged v1 output for one release.

• Writer: sdk-go pkg/transfer/bundle, pinned to the pseudo-version of sdk-go main 17ba39a (PR 233). No tagged sdk-go release has it yet: replace the pin with a tag when one exists.
• Streams: programs (id = program id) and changes (id = program#n); default chunking (about 2,000 records), deterministic by record id.
• Signing: same key and key set; build writes unsigned v2 manifests, the sign step signs them and writes the signed pointer (it pins the signed manifests' digests). A local-only bundle is never signed; it gets an unsigned snapshot.v2.manifest.json with local_only in meta and no pointer.
• verify also checks v2 (pointer, manifest pins, every chunk).
• Workflow unchanged: release uploads out/*, so the v2 files and chunks are included; the previous-release download only needs v1.
• Tests: round trip with the SDK consumer, unchanged input gives identical chunks (also across sequences), one changed program changes one chunk, v1 files and verification unchanged, local-only stays unsigned.

Real local build (diodb, bounty-targets, pd-bounty): 4169 programs -> programs stream 2 chunks (2521 records / 636 KB, 1648 / 98 KB), changes stream 1 chunk (4169 / 27 KB); v1 programs file 733 KB.