feat(op): json and yaml resources are sealed; the Unpacker repair gets a pin - #667

Phase 4 of #625. Closes #643.

The mechanical pass the plan kept predicting and had not yet got. Both providers took the template
unchanged — sealed interface, unexported struct, accessors for Data/Hash/Parsed, two registrations
from init — with no framework repair and no surprise. make test 103 ok on the first run after the
consumers were updated.

mem moved out before this started

function.Resource embeds mem.Resource cross-package:

type Resource struct {
	mem.Resource
	invoker starlarkbridge.Invoker
	...
}

Go cannot embed an unexported type from another package, so sealing mem breaks function at compile
time — the two are coupled and cannot land separately. mem moved to #662 to be sealed alongside
function, where function.resource will embed the mem.Resource interface instead.

Found by surveying before transforming rather than by the compiler afterwards. Verified isolated rather
than a pattern: it is the only cross-package resource embed in the tree.

The Unpacker repair finally has a pin

Phase 1 routed UnpackerByTypeID's reflective probe to the implementation. Nothing asserted it since — it
has been correct by inspection for four phases, and the failure mode is silent: ok=false reads as "this
type has no unpacker," so content rehydration would simply stop.

The first version of the pin was not worth having, and I nearly kept it. It derived its expected set
from ProviderType() — the very value a regression corrupts. Revert the repair and the type stops
implementing op.Unpacker, the derived loop skips it, and the test passes green while content rehydration
is broken. The set is now named explicitly (function, json, mem, yaml), so a fifth unpacker has
to be added here deliberately, and a vanished one fails rather than disappears.

Verification

make test 103 ok / 0 fail · make build · make vet darwin/linux/windows · test-scenario ·
complexity · shell-lint · gofmt -l — all clean.

Metadata preserved without hand-editing: json 2 entries, yaml 2 — #658's generator fix holding on two
more providers it had never seen.

Note preserved, not fixed

Data and Hash carry json:"..." tags, but no resource overrides MarshalJSON, so the promoted base
marshaler writes the URI alone and those tags are inert — the same latent asymmetry recorded for git in
#661. Content survives through Pack/Unpack and the content section, not through the resource's own
JSON. Left exactly as found.