[bayasdev]

A third review found seven low-severity issues; this fixes them.

• reseal now checks the value the sealer made instead of the key id the sealer reports, and sealers and openers are frozen.
• A context's digest is written into one buffer, so a context with tens of thousands of parts no longer overflows the stack.
• The bytes check is noble's own, so an object that only names itself a Uint8Array is refused.
• Keys must be in base64's one spelling of their bytes.
• The Salsa20 constant is read from its bytes, which is what noble expects on a big-endian machine. This is not tested on such a machine.
• Contexts are checked for lone surrogates with a regular expression, so String.prototype.isWellFormed is no longer needed.
• The docs say what the key id is exactly, and that values sealed for the same context can be swapped.
• CI and the release run pnpm audit --prod.

Nothing about the format changes: the value libsodium sealed for the tests still opens.