jsr can avoid native binary downloads

[andykais]

JSR has support for including arbitrary files in a published package https://jsr.io/docs/publishing-packages#filtering-files. That means you could avoid the fetch step during startup and remove two permissions needed during first launch (--allow-net, --allow-write). The actual config would look something like this:

  "publish": {
    "include": [
      "built_native_deps/**/*"
    ]
  }

The downside here is that until jsr has smarter retrieval logic, all native dependencies will be fetched by all platforms, so thats a tradeoff worth thinking about. Imo though this is the right direction rather than an implicit fetch step during first startup.