Add verified npx distribution for Folderbase Core

[jerelvelarde]

Advances #29.

Outcome

Adds a thin, dependency-free @folderbase/cli launcher around native open-source Core, with exact-tag release automation and fail-closed installation.

Included

• selects the four supported macOS/Linux ARM64/x64 assets
• follows a bounded redirect chain, requires HTTPS at every hop, bounds downloads, and accepts only the exact closed checksum set
• verifies SHA-256, installs atomically in a confined user cache, and re-hashes before every execution
• forwards arguments/streams/signals without a shell or orphaned Core process
• verifies the canonical tag and exact remote commit, then smoke-tests ordinary-folder inspect/init/validate
• assembles a complete draft release and refuses publication unless repository immutable releases are already enabled
• isolates the Administration-read settings credential from the short-lived release-write workflow token
• serializes publication with a non-cancelling queue: max group
• compares npm channels and GitHub Latest independently with exact SemVer ordering, so partial publication cannot roll either registry backward
• runs immutable preflight, registry-state decision, and GitHub publication through dedicated tested entrypoints
• exact-byte seals the release workflow and four release-control entrypoints, rejecting conditional bypasses, quoted duplicate keys, escaped commands, and unreviewed control changes
• rejects build-metadata publication versions whose exact identities have ambiguous equal precedence
• verifies the final GitHub Latest relationship even when an immutable release already exists
• makes exact npm reruns integrity-idempotent and cleans interrupted temporary backfill tags
• records the architecture and operational prerequisites in ADR-0008

RED → GREEN

• RED: launcher tests exposed signal, redirect, checksum, cache-path, and oversize-download failures
• RED: publication mutation tests exposed mutable-release, credential-scope, concurrent rollback, SemVer, commented-command, ordering, divergent-registry, conditional bypass, quoted-key, and escaped-command failures
• GREEN: 16 launcher tests and 55 publication/CI/release-entrypoint tests pass
• GREEN: full Core workspace, packed-package command, 197-file candidate closure, JavaScript/YAML/policy/eclipsing gates, and git diff --check pass

Current-head validation (630da43fdbc5ab69bc60b6ac90605ca4cffca710)

• cargo test --workspace --all-features --locked: passed, including Core 441/441
• npm test --prefix packages/npm-cli: 16/16
• release publication, CI mutation, and script-entrypoint suites: 55/55
• packed-package .bin/folderbase acceptance passed
• scripts/check-ci-policy.sh
• scripts/check-public-eclipse.sh
• node scripts/verify-folderbase-version-0.5-distribution.mjs: 197 files
• git diff --check
• prior complete scripts/test-package-install.sh: extracted Core 441/441 plus packaged integration/CLI and optimized-install proof
• exact-head hosted checks are running

Publication boundary

Repository immutable releases are enabled. The release environment still needs FOLDERBASE_IMMUTABLE_RELEASES_READ_TOKEN, scoped to this repository with Administration read only. Release writes keep using GitHub's short-lived workflow token.

The existing empty mutable v0.4.0 release predates the invariant. This PR intentionally refuses to modify it. Recreating that release requires explicit destructive approval.

Initial npm publication also requires the owner to claim @folderbase and configure trusted publishing. @folderbase/cli currently returns E404.

Target definitions are aligned today; consolidation is tracked as non-blocking follow-up #41 before any platform is added or removed.