fix(package): make published tarballs re-packable

[drewstone]

Problem

Published package tarballs retain prepare: tsup. Re-packing an installed tarball with lifecycle scripts enabled therefore invokes a development-only binary that is absent from consumer installs and exits 127.

Solution

• Move the publish build to prepublishOnly so normal tarball operations do not require development dependencies.
• Add a focused package proof that installs a freshly built tarball into an empty npm project with scripts enabled, imports the five non-CLI public modules, validates the installed CLI version, and re-packs the installed package with scripts enabled.
• Run the proof in pull-request CI and the tag verification job before publishing.

Verification

• pnpm lint: 98 files checked
• pnpm typecheck: passed
• AGENT_KNOWLEDGE_RUN_NETWORK_TESTS=1 pnpm test: 287 passed, 5 skipped across 31 files
• pnpm build: passed
• pnpm verify:package: clean install, 5 imports, CLI version, and re-pack passed
• actionlint .github/workflows/ci.yml .github/workflows/publish.yml: passed

The full check set also passed under Node 22.22.3, matching both workflows.

[tangletools]

✅ Auto-approved drewstone PR — a4796275

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-07-16T18:08:33Z}