Add the published-vs-local byte diff used to verify v0.4.27

Compares the published wasm (`moonx riantr/moonbit_static_analysis@0.4.27`)
against the local build over three corpora. All three are identical on the
analyzer's own report lines: moui 3,590, async 1,289, proton 890.

It arrived after the release commit rather than inside it, so `v0.4.27` keeps
pointing at the commit CI already verified rather than being rewritten.

Four measurement traps are recorded in the script header, each of which
produced a false verdict before it was fixed:

- `cmd.exe /c "... > file"` with embedded quotes silently writes nothing; six
  0-byte captures once printed a line per corpus and exited 0. Start-Process
  takes an argument array and needs no quoting.
- `2>&1 | Out-String` merges stderr as formatted error RECORDS. moonx prints
  "Registry index updated successfully" there, and the merge wrapped it in a
  stack trace -- 1,236 "differing" lines, none of them findings.
- moonx prints its own progress lines (`Info:`, `FETCH`, `WALKING`) and a
  coordinate in `TARGET`, so whole-stream comparison is not a comparison of two
  builds. The filter keeps only the analyzer's report vocabulary.
- Paths differ by separator AND by prefix: moonx writes `...\.repos/wzzc-dev/
  moui/0.1.12/moui.mbt`, local writes the whole thing with backslashes. One
  marker is now produced by the same rule on both sides; an earlier version
  emitted `<corpus>` locally and `<corpusroot>` from moonx, which is 1,168 of
  3,590 lines differing over one rename applied to a single side.

The local run also omits `--extern-iface-dir`, because moonx does not pass it.
With the flag on the local side only, 1,170 lines differed -- including the
IFACE banner -- which measures the invocation, not the build.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
