feat(toolkit): build compact-js/platform-js from pinned midnight-sdk submodule

[gilescope]

Overview

util/toolkit-js/compact-0.31 previously pinned @midnight-ntwrk/{compact-js,compact-js-command,compact-js-node}
(and platform-js transitively) from the npm registry. This PR builds them from source instead, from a new
midnight-sdk/ git submodule pinned to the signed cjs-2.5.1 release tag — the submodule commit, not the
registry, becomes the version of truth. Same pattern as the existing compact/ compiler submodule.

• midnight-sdk/ submodule @ 7795a74 (tag cjs-2.5.1)
• scripts/build-midnight-sdk-js.sh builds all four packages into .midnight-sdk-js/*.tgz using the
  submodule's own yarn scripts, adapted for credential-free builds: public-npm registry override (its
  yarn.lock pins authenticated npm.pkg.github.com archive URLs), in-tree platform-js cross-wired into
  compact-js, sibling deps pinned to the exact built versions so npm dedupes onto the local set
• Tarballs are byte-reproducible across machines/OSes (gzip envelope normalized: level-0, pinned OS byte),
  so the file: integrity hashes in package-lock.json are stable
• +midnight-sdk-js Earthly target (pinned node image) runs the script; +midnight-sdk-js-local exports
  to the host; +toolkit-js-prep consumes the artifact before npm ci
• compact-0.29/compact-0.30 compat variants keep their registry pins
• Renovate already tracks git submodules; a bump without rebuilding fails loudly at npm ci (EINTEGRITY)

🗹 TODO before merging

• Ready

📌 Submission Checklist

• All commits are signed off (git commit -s) for the DCO
• Changes are backward-compatible (or flagged if breaking)
• Pull request description explains why the change is needed
• Self-reviewed the diff
• I have included a change file, or skipped for this reason:
• If the changes introduce a new feature, I have bumped the node minor version
• Update documentation (if relevant)
• Updated AGENTS.md if build commands, architecture, or workflows changed
• No new todos introduced

🧪 Testing Evidence

• earthly +midnight-sdk-js-local output matches the committed lockfile integrity hashes byte-for-byte
• Cross-platform reproducibility: macOS-arm64 host build vs node:23.11.0 linux container build → identical sha256s
• earthly +toolkit-js-prep green end-to-end (submodule build → npm ci → build → contract compilation → key check)
• Locally: clean npm ci + npm run build + vitest green with compactc 0.31.0

🔱 Fork Strategy

• N/A — build/tooling only; no node runtime or client change

Links