Switch manifest serialization to CBOR

Replace JSON-based bundle manifest with a CBOR-encoded format. The manifest
is now a canonical CBOR map with order-strict key decoding, raw 32-byte hash
payloads (instead of hex-encoded JSON), and compact binary representation.

ext/js/src/bundle.js

@@ -18,9 +18,12 @@
  *     Offset        8B  u64 BE
  *     Length        8B  u64 BE
  *     SHA256Digest 32B raw
+ *   Manifest: canonical CBOR-encoded map (cborg output from Haskell)
+ *   Nodes: binary section
  */
 
 import { createHash } from "node:crypto";
+import { decodeCbor } from "./cbor.js";
 
 // ── Constants ───────────────────────────────────────────────────────────────
 
@@ -170,12 +173,37 @@ export function parseBundle(buffer) {
 }
 
 /**
- * Convenience: parse and return just the manifest JSON.
+ * Post-process a CBOR-decoded manifest to normalize hash fields
+ * from raw bytes to hex strings (matching the old JSON wire format).
+ */
+function normalizeManifest(raw) {
+  const tree = raw.tree;
+  if (tree && tree.nodeHash && tree.nodeHash.domain) {
+    tree.nodeHash.domain = tree.nodeHash.domain;
+  }
+
+  // Convert root hashes from raw bytes to hex
+  const roots = (raw.roots || []).map((r) => ({
+    ...r,
+    hash: r.hash instanceof Uint8Array ? Buffer.from(r.hash).toString("hex") : r.hash,
+  }));
+
+  // Convert export root hashes from raw bytes to hex
+  const exports = (raw.exports || []).map((e) => ({
+    ...e,
+    root: e.root instanceof Uint8Array ? Buffer.from(e.root).toString("hex") : e.root,
+  }));
+
+  return { ...raw, roots, exports };
+}
+
+/**
+ * Convenience: parse and return the manifest from CBOR.
  */
 export function parseManifest(buffer) {
   const bundle = parseBundle(buffer);
   const manifestEntry = bundle.sections.get(SECTION_MANIFEST);
-  return JSON.parse(manifestEntry.data.toString("utf-8"));
+  return normalizeManifest(decodeCbor(manifestEntry.data));
 }
 
 /**