resolveNativeOrtBindingPath ownership

Trap: createRequire(...).resolve() ancestor walking looks necessary for npm hoisting, but it can select a matching undeclared or injected workspace installation and contradict strict worker-package ownership. Fix: root native lookup in the selected embedding-worker package’s declared dependency boundary, prefer @loreai/onnxruntime-<target>, and return null on any resolution, ownership, libc, metadata, containment, or validation failure so WASM fallback is never interrupted.