feat: add Node SEA binary build support

[netbrah]

Summary

Add scripts for building standalone Single Executable Application (SEA) binaries, enabling qwen-code distribution without requiring Node.js installation on target machines.

What's included

• scripts/build_binary.js — Full SEA packaging pipeline: reads esbuild bundle, generates manifest with SHA-256 integrity hashes, creates SEA blob via node --experimental-sea-config, injects into Node binary via postject, handles macOS code signing and universal binary extraction
• sea/sea-launch.cjs — Runtime asset extractor for SEA binaries: extracts embedded assets to a secure temp directory with integrity verification, handles atomic directory creation via rename, supports cross-platform (macOS/Linux/Windows)
• npm scripts: build:binary, apex (macOS bundle copy), apex:linux (Docker cross-build), apex:all

How it works

macOS: The esbuild bundle (dist/cli.js) already has a #!/usr/bin/env node shebang — npm run apex simply copies it to .bin/apex. No SEA packaging needed, runs on system Node.

Linux cross-build: npm run apex:linux uses Docker buildx to build a self-contained SEA binary for linux/amd64 inside a container, extracting just the binary. No Node.js required on the target machine.

Test plan

• npm run bundle produces dist/cli.js (18MB)
• node scripts/build_binary.js completes successfully on macOS arm64
• Output binary is a valid Mach-O executable with SEA blob injected
• npm run apex copies bundle to .bin/apex with correct shebang
• Docker cross-build for linux/amd64 (requires Docker buildx)

Made with Cursor

[netbrah]

Fixes #2359