safe-bash: add `getopt` (enhanced long-option parser)

[kamilio]

Missing: getopt (the util-linux long-option parser). Only the POSIX getopts builtin (short options) exists.

Behavior: getopt -o SHORT --long LONG -- "$@" with -- termination and quoted re-emission. Note #667 (getopts O(n²)) is a separate perf bug in the builtin; this is the missing long-option command.

From the safe-bash command gap analysis (2026-09-08). Sandbox constraints apply: bounded input/CPU/memory, VFS-only paths, cooperative cancellation, no host process/network beyond the existing curl authorizer.

[kamilio]

Implemented and verified on remote main at 95bb5a1. Enhanced getopt is in the default preset and root/scoped public APIs, with saved-VFS-script getopt/eval/set workflows. Exact finite comparisons use util-linux 2.34/glibc 2.31; documented resource limits, locale/syntax restrictions and virtual help/version banners remain explicit. Separate atomic fixes preserve raw bytes through trimming, eval, xargs and mapfile callbacks. Full maintained tests, clean lint, final normal build, 26 type groups, committed archive and package lint pass. Fresh packed consumers pass 22/22 profiles and 43/43 commands across Node/Bun, root/scoped packages and Node-executed browser bundles; no real-browser claim. Release publication is monitored separately; this closure records verified remote-main delivery.