Make native ONNX Runtime resolution fail closed to WASM

Always treat native ONNX Runtime as an optional optimization whose discovery or loading failures must never crash or interrupt embedding. Resolver functions must catch all errors and return null when packages are absent, invalid, unsupported, or unresolvable, allowing the WASM fallback to proceed. Search only the worker package’s own declared dependencies and node_modules; never select an arbitrary ancestor or unrelated onnxruntime-node installation. Validate package metadata, canonical paths, containment, and platform binary signatures before use. Preserve ONNX Runtime’s default thread configuration on unrestricted hosts, applying an intra-op override only when availableParallelism() is genuinely lower than os.cpus().length.