Add dependency-free Linux support and portable schema integrity

[ThorFuchs]

JSONSchema's CryptoKit import prevented Linux builds. Replace it with original package-private SHA-256 using the active cumulative compilation meter, bounded scratch and cancellation. Retain all nine resource pins, four public products, private regex runtime and the empty dependency graph.

Add Ubuntu 24.04/glibc qualification on ARM64 and x86_64 with pinned Swift 6.4. Preserve Apple requirements and required Native check names/settings. The integrated source retains main's cumulative schema-builder accounting and all nine regression cases.

Validation on 6f7ebf8d6cf3231fd443ef1974f111e54e1ae9e3:

• Apple native/safety/docs and Linux native/safety on both architectures passed. Each full root test run requires 189 functions and 173 parameterized invocations; shared-state safety requires six functions. Address/Leak Sanitizer and strict memory safety pass without suppressions.
• All 49 cap probes; 20 rooted consumer cases (8 positive, 12 negative, 2 operational errors); syntax 318 observed (287 evaluated, 31 policy), schema 2337 observed (2300 evaluated, 37 policy), authored 82, budgets 9, malformed replay 4396.
• Both Linux clean-extraction builds exercise all products, six integrity/resource functions and the external consumer. Their archives match the independently produced local archive: SHA-256 166c53fcac0de09e5f322cd6b16126ce8560b333288c7caa491917d07178a3dd, 1,142,319 bytes, 810 entries. All seven lane source manifests and command-log hashes are checked against those actual bytes.
• Local Xcode 27.2/Swift 6.4 integration checks passed all 14 affected builder/integrity functions. Native DocC covers 582 authored public symbols and compiles the README consumer.

Standalone probes reproduce the pinned Linux runtime's empty XCTest and Foundation empty-file leaks. Linux starts Swift Testing only; no behavior case is removed. Fixture FileHandle I/O retains the zero-byte rejection vector. Consumer resource lookup follows actual Apple/Linux layouts. Diagnostic nonzero exits remain distinct from package test results.

Linux receipts and Native receipts.

WebAssembly and broader distributions/libc remain unqualified. Release tagging and publication are separate.