Add tolerant OKF frontmatter and advisory metadata helpers

[adamokon]

This first native OKF building block preserves structured provenance and unknown frontmatter metadata, and adds an advisory OKF 0.2 metadata reader. The existing builder previously dropped unknown null/prototype-named extension values, accepted non-delimiter suffixes and sequence mappings, and coerced invalid producer types. Legacy string-only deletion keys remain unchanged, so external provenance URLs are never converted into raw-file deletion keys.

Four files only: the existing frontmatter helper, a pure metadata reader, focused tests and English usage/scope documentation. No new dependency, network access, instruction execution, routes, bundle transport, graph-link parser or ingestion/cascade integration. Unknown types/optional metadata remain consumable; producer actor names and returned verification tiers are assertions, not authenticated identities or an independent audit.

Reviewed against official OKF 0.2 specification commit ad30107c31c06aec8a7d5636e0d1058118604e6f; based on fresh TencentDB upstream 37b162963ce6cf73d8ae1807e3f3614ad23511ae.

Linux validation with real installed dependencies and synthetic data:

• 13 focused tests and application build pass on Node 22; five original frontmatter defects were reproduced separately against the upstream helper.
• A 150,000-event verification family exposed a function-argument stack overflow in the previously prepared reader; reducing timestamps instead of spreading them passes that regression.
• With the separate compiler correction proposed in Fix MemoryKnowledge typecheck by preserving Hono request cache #1649 overlaid only in the private test fixture, whole Knowledge typecheck, all 13 tests and builds pass on Node 22 and Node 24.
• Without Fix MemoryKnowledge typecheck by preserving Hono request cache #1649, the feature retains the same single inherited upstream response-envelope.ts TS2322 diagnostic. No whole-project zero-error claim for this feature alone.

Limitations: timestamps use finite JavaScript parsing with timezone markers, citation warnings are lexical, builder whitespace/handled optional-null/locked rules remain, and callers must budget input size. This is not a complete importer/exporter, byte-preserving transport, authorization boundary or recovery solution. The current upstream resolved dependency graph has separately tracked advisories; this proposal leaves package metadata unchanged and does not remediate that graph. The complete fork remains separate from this incremental proposal. Independent final review is outstanding; please review this bounded building block before integration proposals.

[Maxwell-Code07]

Thank you so much for your attention and contribution! We will arrange an internal review for this PR shortly, and all feedback will be shared right here in the discussion.