Reproducible builds: vendor scripts embed wall-clock timestamps in vendored outputs

[debugmcpdev]

Problem

Two identical clean builds from the same commit do not produce byte-identical vendored outputs, because the vendor scripts stamp wall-clock time into their metadata:

• packages/adapter-javascript/scripts/build-js-debug.js — writeManifest() writes fetchedAt: new Date().toISOString() into the js-debug vendor manifest.
• packages/codelldb-common/scripts/vendor-codelldb.js — writes cachedAt: new Date().toISOString() (cache metadata, ~line 282) and downloadedAt: new Date().toISOString() (vendor metadata, ~line 537).

This blocks independent verification that a rebuild from source matches what was published (the OpenSSF Best Practices build_repeatable criterion) and adds diff noise to any workflow that compares vendor outputs.

Fix

Make the stamps deterministic or remove them from anything that ships:

• Prefer deriving from stable inputs: honor the standard SOURCE_DATE_EPOCH convention when set, falling back to the upstream release/asset date (both engines are already digest-pinned in their manifests, so the date carries no integrity weight).
• Where a field is purely local cache bookkeeping, keep it out of files included in packages — the digest pins already carry the integrity information.

Acceptance

Two consecutive pnpm run vendor:force && npm run build runs from the same commit produce byte-identical vendor/ trees and identical shipped package contents.

[debugmcpdev]

Fixed in #428 (squash b421391) by removing the two shipped stamps rather than deriving them: fetchedAt (js-debug manifest, shipped in adapter-javascript) and downloadedAt (platform version.json, shipped in codelldb-common + the five platform packages). Neither had a consumer — integrity lives in the committed vendor-manifest.json digest pins, and the resolver/staging read only version/platform. With no timestamps left in any shipped output, SOURCE_DATE_EPOCH plumbing became unnecessary. The cachedAt stamp stays: it lands in cache metadata under the user cache dir and never ships.

Acceptance verified on win32: two consecutive pnpm run vendor:force && npm run build runs from the same commit produced byte-identical vendor trees (recursive sha256 over vendor/js-debug and all five vendor/codelldb/<platform> trees) and identical packed-tarball sha256s for @debugmcp/adapter-javascript, @debugmcp/codelldb-common, and the staged @debugmcp/codelldb-win32-x64.