Migrate mongodb-client-encryption off the prebuild-install install script so it installs under npm 12, which blocks dependency install scripts by default.

Approach

Same model as kerberos (NODE-7679, the pilot): each prebuilt binary is published as its own package, @mongodb-js/mongodb-client-encryption-<target>, with os/cpu/libc fields. mongodb-client-encryption lists them as exact-version optional dependencies, so the package manager installs only the matching one and no install script runs. Targets are the same as today's prebuilds. Platforms without a prebuild build from source manually, and a local build takes precedence.

This model keeps downloads small. Each prebuild is ~3.3 MB on disk (libmongocrypt, kms_message and libbson are statically linked), so bundling all 8 targets in one tarball would be ~18 MB to download, against ~2.3 MB for the one a user needs.

Acceptance Criteria

Implementation Requirements

• prebuild-install dependency and the install script removed, "gypfile": false.
• Loader tries the local build, then the platform package, and throws an error naming the platform.
• Release workflow publishes the platform packages first, then mongodb-client-encryption, with provenance and signing covering every tarball, as in NODE-7679.
• The platform package names exist on npm with publishing configured.

Testing Requirements

• Loader test covers every target.
• CI installs the packed packages into a fresh project with npm 12 and loads the addon without approving install scripts.

Documentation Requirements

• README: platform packages and building from source.

Follow Up Requirements

• N/A