jsr can avoid native binary downloads

JSR has support for including arbitrary files in a published package https://jsr.io/docs/publishing-packages#filtering-files. That means you could avoid the fetch step during startup and remove two permissions needed during first launch (`--allow-net`, `--allow-write`). The actual config would look something like this:
```json
"publish": {
"include": [
"built_native_deps/**/*"
]
}
```
The downside here is that until jsr has smarter retrieval logic, all native dependencies will be fetched by all platforms, so thats a tradeoff worth thinking about. Imo though this is the right direction rather than an implicit fetch step during first startup.