feat: add optional binary patch metadata

[floyd-soomgo]

Summary

Third PR of the binary differential OTA series (stacked on feat(cli): generate platform binary patch artifacts).

PR 2 uploads the patch archive but discards its URL after logging it. This PR carries that URL end-to-end as optional metadata: the CLI stores it in the release history JSON, and the JS runtime passes it from the fetched history through to the object handed to native downloadUpdate. Native does not consume the field yet — the Android/iOS appliers (next PRs) will download and apply the patch, with a one-time fallback to the full archive.

Compatibility is the point of the design:

• Old library versions ignore the unknown JSON field and keep using downloadUrl — nothing to coordinate.
• A history without the field behaves exactly as today (pinned byte-identical in tests, key order included).
• Removing the field from a history JSON and re-uploading is the emergency kill switch: clients silently return to full-only updates.

Changes

• Typings — ReleaseInfo.binaryPatchDownloadUrl?, RemotePackage.binaryPatchDownloadUrl?, and binary_patch_download_url? on the deprecated UpdateCheckResponse. Additive only.
• CLI — addToReleaseHistory records the patch URL in the same platform entry when (and only when) the patch archive was uploaded. No patch, or a patch skipped by --on-oversized-patch, leaves the entry without the key.
• JS runtime (src/CodePush.js) — the field flows through the two mapping points between the fetched history and the remote package. The absent case is handled with a conditional spread on purpose: package-mixins copies the remote package with Object.assign into the native call, so a plain binaryPatchDownloadUrl: undefined assignment would have shipped the key to native. Tests assert absence with toHaveProperty (not toEqual, which ignores undefined-valued keys). package-mixins itself is unchanged, and the TurboModule spec (UnsafeObject) passes the field through as-is.
• Test infrastructure — src/CodePush.js contains JSX and the repo's Babel config has no JSX transform, so no jest test could load this module before. Added a root jest.config.js with a small transformer that compiles just that file using TypeScript (already a devDependency — no new packages). The new src/CodePush.test.js drives the real code path: real history JSON fixtures, the real package-mixins, only the native bridge mocked, asserting the actual downloadUpdate argument. Maintainer note: if you'd rather add @babel/preset-react, both jest files can be deleted with no test changes.
• Docs — the release-history field documented in docs/api-js.md and both CLI READMEs.

Test plan

npm run jest        # root suites (now includes src/CodePush.test.js) + cli suites
npm run typecheck