safe-bash: add `hexdump` (alias/format over the existing xxd/od engines)

[kamilio]

Missing: hexdump. xxd and od exist, but many scripts call hexdump/hd.

Behavior: GNU/BSD hexdump [-C] [-v] [-n LEN] [-s SKIP] [-e FORMAT] and hd (= hexdump -C). Can reuse the bounded byte-dump engine already backing xxd/od; -e custom formats optional. Bound input and format complexity.

From the safe-bash command gap analysis (2026-09-08). Sandbox constraints apply: bounded input/CPU/memory, VFS-only paths, cooperative cancellation, no host process/network beyond the existing curl authorizer.

[kamilio]

Delivered directly to main and verified remotely at cc19470 (feature commit baac1a1, with follow-up lifecycle fixes). Adds bounded VFS-only hexdump and hd, including -C, -v, -n and -s. Custom -e/-f formats remain explicitly unsupported, as permitted by the issue. Validation includes original-source review, finite Linux BSD hexdump stdout/stderr/status comparisons, cancellation/resource tests, full maintained workspace tests and lint, committed-archive checks, and 22 fresh packed-consumer profiles / 43 commands. Browser bundles were executed under Node, not a real browser. The final merge changes only the separately actionlint-checked terminal publication workflow; runtime/package bytes are unchanged from the qualified candidate. Closing after verified remote-main delivery; release publication is being monitored separately.