Report bundle does not record oversized-file omissions inside the ZIP

ultrafuzz report bundle can return success while skipping an oversized engine log. The omission appears in the CLI diagnostic but is not recorded in bundle-manifest.json, so someone who receives only the ZIP cannot determine which evidence was omitted or why.

Observed behavior: a valid ZIP and report were produced with REPORT_BUNDLE_FILE_SKIPPED for smithers/logs/stream.ndjson because it exceeded the 64 MiB per-file limit. The source log remained on disk. The archive manifest lists engine-logs among included roots but contains no per-file omission inventory. This concerns bundle completeness, not corruption of included reports.

Current implementation: packages/cli/src/commands/report/bundle.ts defines MAX_BUNDLE_FILE_BYTES, emits a warning when readRegularFileSnapshot refuses a file, and constructs a manifest with included/excluded roots, one excluded filename pattern, path mappings, and entry count. It does not persist these skip diagnostics in the archive.

Minimal synthetic reproduction:

1. Start with a small valid sealed run and its verified report.
2. Add an engine log larger than 64 MiB using generated dummy data.
3. Run the native bundle command and retain only the resulting ZIP.
4. Inspect bundle-manifest.json: the oversized log is absent and the reason cannot be recovered from the archive.

Acceptance criteria:

• Include a structured omission list using run-relative paths, reason codes, and known source sizes in a versioned manifest or another bundled manifest file.
• Distinguish intentional exclusions from files skipped because of size, file type, or read failure.
• Validate this information with the bundle schema and test it with synthetic inputs.
• Consider bounded log chunks or a separately requested logs archive, while preserving resource limits and the source files.

Related: #530 addressed filename filtering; this is the distinct oversized-file and self-contained omission-accounting case.

Sanitized: no target identity, run identifiers, host paths, raw logs, or findings are included.

Start at packages/cli/src/commands/report/bundle.ts and the native report bundle entry point, tracing readRegularFileSnapshot, MAX_BUNDLE_FILE_BYTES, warning emission, and manifest construction. Use a synthetic sealed run with an oversized engine log, then validate that bundle-manifest.json records run-relative omissions, reason codes, and source sizes while distinguishing intentional exclusions and checking the bundle schema.