feat: --ignore-node-options to keep the embedded V8 code cache valid

[BYK]

Problem

A Node SEA built with an embedded V8 code cache (useCodeCache) emits
Warning: Code cache data rejected at startup — and silently falls back to
recompiling the main script — whenever the user has V8 flags in NODE_OPTIONS
(e.g. NODE_OPTIONS=--max-old-space-size=8192, a very common Claude Code
setup). Those flags change V8's FlagList::Hash() at runtime, so it no longer
matches the build-time default the cache was generated against, and V8 rejects
the cache.

This was diagnosed from a real report: the same binary was accepted on a
machine with no NODE_OPTIONS and rejected on one with V8 flags in
NODE_OPTIONS; env -u NODE_OPTIONS <binary> made the warning disappear.

Fix

New opt-in --ignore-node-options flag. It makes the produced binary ignore
NODE_OPTIONS — the equivalent of building Node with
./configure --without-node-options, achieved via an in-place binary patch
(same model as the existing hole-punch step):

• Renames the single .rodata NODE_OPTIONS C-string that the C++ bootstrap
  feeds to SafeGetenv() to a same-length inert name (NODE_OPTIQNS), so
  getenv() returns null and no V8 flags are applied from NODE_OPTIONS.
• The runtime flag-hash then matches the build-time default → the embedded
  code cache is accepted (kept; no --no-code-cache tradeoff).
• process.env is untouched, so process.env.NODE_OPTIONS is still visible to
  the app and still inherited by any child process it spawns.

Applied after strip, before code-cache generation and signing, so both the
generated cache and the final signature cover the patched bytes.

Robust, format-agnostic target selection

A Node binary holds ~10 copies of the literal NODE_OPTIONS (help/error text,
JS bootstrap, and copies inside the checksummed V8 startup snapshot which
must not be touched). The patch targets the .rodata lookup constant by
selecting the occurrence that is null-bounded (\0NODE_OPTIONS\0) and
surrounded on both sides by C-string bytes (NUL/printable-ASCII). This excludes
the JS/error copies and the snapshot copies (which sit next to non-printable
serialized bytes). It throws if no candidate is found so a future Node
layout change fails the build loudly instead of shipping a binary whose cache
would be rejected.

Verified to patch exactly one offset on official node-v22.14.0
darwin-arm64, linux-x64, linux-arm64 and win-x64 builds.

Verification

• Reproduced Code cache data rejected on a real linux-x64 code-cache SEA with
  NODE_OPTIONS=--stack-trace-limit=99; after the patch the warning is gone and
  the cache is still embedded.
• New CI step (Test --ignore-node-options keeps the code cache valid under NODE_OPTIONS) builds with the flag and asserts no rejection while running
  under NODE_OPTIONS.
• process.env.NODE_OPTIONS confirmed still present (children still inherit it).