Port gRPC certificate-provider credential integration

Tracks copied Bun corpus position 3979 from #66: js/third_party/grpc-js/test-end-to-end.test.ts.

The sole upstream case is currently skipped, so this issue also requires an active Home regression proving the underlying behavior.

Acceptance criteria:

• make shared loadProtoFile lowering independent of a local grpc namespace
• implement certificate-provider server/channel credential factories with provider validation and contextual causes/stacks
• support the metadata + call-options + callback unary overload
• prove an in-memory TLS-provider EchoService round trip in an active Home regression
• preserve the upstream skip as one todo, with zero failures/unsupported results, and pin the file permanently

Parent: #66

Completed in 6d7e83e6479d97f0c6ce56835ddd7a9fc73b9ff3 and pushed to main.

• Shared loadProtoFile lowering now resolves grpc-js directly and no longer depends on a local grpc namespace.
• Added certificate-provider server/channel credential factories with secure identity, provider validation, activation/deactivation lifecycle, and cause-preserving provider-role stack context.
• Added metadata + call-options + callback unary overload handling and deadline validation.
• The copied upstream case remains its intentional skip: 0 passed, 1 todo, 0 failed, 0 unsupported.
• A new active Home regression proves the skipped provider round trip and listener cleanup; diagnostics, SQL, and the permanent third-party suite pass.