feat(remap): add ordered safe destination mappings

[rafaio1]

What this does / 这个 PR 做了什么

Generalizes stripPrefix into ordered remap: [{ from, to }] rules while
keeping stripPrefix as backward-compatible sugar. It also closes two
collision-safety gaps found during review: every configured rule must actually
win at least one match, and equivalent destination aliases are canonicalized
before collision detection and writing.

The design remains credited to @xusuxiang8 from the now-unreachable PR #3.
Traversal-on-configured-values is carried forward from @rafaio1's PR #2, as
requested by the task.

Acceptance criteria / 验收标准

• remap is accepted and validated in src/config.mjs and registered in
  KNOWN_KEYS.
• Existing stripPrefix configs produce byte-identical packs to the
  equivalent single-rule remap form.
• Collisions fail and name both source paths, including mapped/unmapped
  orderings, two mapped sources, and canonical aliases.
• Traversal is rejected in configured from/to values and in resulting
  destination paths.
• Tests cover multiple mappings, first-match ordering, collisions,
  traversal, unused/shadowed rules, no-match errors, manifests, and
  stripPrefix compatibility.
• README and sparepack init document the feature.
• npm test passes in sparepack.

How I verified it / 我是怎么验证的

Validated on the PR head b825a02df348f668f5b6b7323c6df39a1fa2a7b1
in a clean Linux checkout with Node.js 22.23.2:

npm test
97 tests, 97 passed, 0 failed

node bin/sparepack.mjs --help
exit 0

npm pack --dry-run --json
sparepack@0.1.1, dry-run completed

git diff --check
no errors

The executable bit on bin/sparepack.mjs remains 0755. An independent
adversarial review reproduced the path-alias overwrite on the earlier head;
the regression cases for ., duplicate separators, ./, backslashes, both
source orderings, and two remapped sources now pass.

Notes for the reviewer / 给审阅者的说明

• First match wins for each file.
• A fully shadowed rule is considered unused and is a hard error.
• MANIFEST.json records canonical post-remap paths.
• stripPrefix remains supported without a deprecation warning.

---

Attestation / 声明

The technical change has been reviewed and validated by the active Codex
session, but the personal account-owner attestations below are intentionally
left unchecked until the account owner confirms them directly.

• I reviewed every line of this change myself and I understand it.
• I used my own subscription account and shared no credentials with anyone.
• I did not route anyone else's requests through my account.
• This PR contains no credentials, API keys, tokens, or secrets.

Task: mxx1111/spare-cycles#19

[rafaio1]

Revalidated the current PR head after a clean dependency install: node --test test/*.test.mjs reports 91/91 passing. I also corrected the PR description so it accurately reflects that this branch contains the full remap implementation plus the requested regression tests. The branch is mergeable and ready for maintainer review.