safe-bash: add `cmp` (byte-level file comparison)

[kamilio]

Missing: cmp. Only diff exists; scripts use cmp for fast byte-equality and first-difference reporting.

Behavior: GNU cmp file1 file2 → silent + exit 0 when equal, file1 file2 differ: byte N, line M + exit 1 otherwise; support -s/--silent, -l (list all differing bytes, octal), -n (limit), and - for stdin. VFS paths only.

From the safe-bash command gap analysis (2026-09-08). Sandbox constraints apply: bounded input/CPU/memory, VFS-only paths, cooperative cancellation, no host process/network beyond the existing curl authorizer.

[kamilio]

Implemented and verified on remote main at adc4d5b. Validation includes native differential/contract coverage, the maintained full unit route for the integrated utility changes, final build/lint/consumer checks, and freshly packed Node/Bun/browser-profile consumers. Truncate uses the explicitly selected Linux64 indexed-ext4 profile. This is scoped compatibility, not an all-platform or all-input equivalence claim. Release workflows 34395450680 (poe-code) and 34395450065 (scoped safe packages) are being monitored; publication is not yet claimed.