Migrate kerberos off the prebuild-install install script so it installs under npm 12, which blocks dependency install scripts by default (pnpm 10 and Bun do the same).

Approach

Per-platform npm packages, as used by esbuild, @swc/core, sharp and @parcel/watcher. Each prebuilt binary is published as its own package, @mongodb-js/kerberos-<target>, with os/cpu/libc fields. kerberos lists all of them as exact-version optional dependencies, so the package manager installs only the matching one and no install script runs.

Targets (same as today's prebuilds): darwin-universal, win32-x64, win32-arm64, linux-x64, linux-arm64, linux-s390x (glibc), freebsd-x64, freebsd-arm64.

Platforms without a prebuild build from source manually (cd node_modules/kerberos && npm run build). A local build takes precedence over the prebuilt binary.

This is the pilot for the same model in mongodb-client-encryption (NODE-7680).

Acceptance Criteria

Implementation Requirements

• prebuild-install dependency and the install script removed. "gypfile": false so npm does not run an implicit node-gyp rebuild.
• Loader (lib/util.js) tries build/Release, then build/Debug, then the platform package, and throws an error naming the platform and pointing to the build-from-source docs. Every require is a string literal inside a try block so webpack can resolve them.
• CI build jobs produce prebuilds/<target>/kerberos.node. A script generates the platform packages and the main package's pinned optional dependencies from one target list.
• Release workflow publishes the platform packages first, then kerberos, all with provenance. Already-published versions are skipped so a failed run can be retried.
• The 8 @mongodb-js/kerberos-* package names exist on npm with publishing configured for the release workflow.
• Signing covers every published tarball. sign_node_package in drivers-github-tools currently signs one npm tarball plus build-/.tar.gz, so it needs extending, or the workflow calls gpg-sign directly.
• The signed GitHub release tarball for kerberos is the same file that is published to npm (the published package.json has the generated optional dependencies).

Testing Requirements

• A test checks that the loader requires a package for every target in the target list.
• Webpack bundling test installs the generated packages and runs the bundle.
• CI installs the packed packages into a fresh project with npm 12 on every built platform and loads kerberos without approving install scripts.
• Manual source build documented and checked to take precedence.

Documentation Requirements

• README: prebuild platforms, how the platform packages work, building from source, release integrity for the platform packages.
• AGENTS.md updated for the new build and release commands.

Follow Up Requirements

• Decide major vs minor release (prebuild-install's binary-host mirror options go away).
• Apply the same model to mongodb-client-encryption (NODE-7680).