refactor(golden): drive real BuildContext/PackageContext, drop pipeline reimplementation

The previous harness reimplemented pieces of the build/package flow
(running the SAM translator manually, walking artifact properties,
calling internal merge helpers directly), and that drift produced
two user-visible bugs in the pinned outputs:

  1. ``Fn::ForEach`` was replaced with the expanded form. Real
     ``sam build`` preserves the ForEach so CloudFormation can re-expand
     it server-side at deploy time (PR #8637).
  2. ``AWS::Serverless::Function`` got SAM-transformed to
     ``AWS::Lambda::Function`` (with an auto-generated IAM Role). Real
     ``sam build`` does NOT run the SAM transform; that happens
     server-side at deploy.

Both were symptoms of running steps SAM CLI itself does not run. Fix
the underlying issue by driving the same ``BuildContext`` and
``PackageContext`` classes the CLI instantiates and stubbing only the
network/compute boundaries:

- ``ApplicationBuilder.build`` returns an ``ApplicationBuildResult``
  with artifacts pointing at a sentinel directory under
  ``<build_dir>/__sam_golden_artifact__/<full_path>/``. The placeholder
  file's content is the resource's full path, which makes the
  downstream content-addressed S3 URI deterministic per resource.
- ``S3Uploader.upload`` / ``upload_with_dedup`` return
  ``s3://golden-bucket/<sha256>`` where the digest is taken over the
  uploaded file's content.

After build, the on-disk ``.aws-sam/build/template.yaml`` is read back
and any artifact-property string that resolves under the sentinel
directory is rewritten to ``<<BUILT_ARTIFACT>>``. Everything else
(LE expansion, ForEach merge, Mappings generation, AWS::Include
export) flows through the real CLI code paths.

Also: ``samcli.yamlhelper.yaml_parse`` mutates the global
``yaml.SafeLoader`` to emit ``OrderedDict``; once any caller imports
yamlhelper, every subsequent ``yaml.safe_load`` returns OrderedDict
and ``yaml.safe_dump`` rejects it. Coerce parsed templates to plain
``dict`` in both the harness and ``normalize`` so the test corpus and
pin regenerator see plain dicts.

Test signatures change: ``run_package_pipeline`` no longer takes a
``build_output`` dict (PackageContext re-loads the template from
disk); a new ``run_build_and_package`` helper produces both pins
from a single build for callers that need both.

Author: bnusunny