fix: preserve npm CLI entrypoint

[cloudsbeyond]

Summary

• normalize the npm bin path so npm does not remove it during publish
• assert the packed manifest retains the CLI mapping
• record the packaging failure and verification evidence in the release trace

Validation

• Node 20: 15 files / 117 tests, typecheck, build, 21-file pack dry-run
• Node 22: 15 files / 117 tests, typecheck, build, 21-file pack dry-run
• packed CLI manifest and direct CLI execution passed
• pnpm security:audit: no known production vulnerabilities

The first npm publish attempt wrote no version: npm rejected it before registry mutation because account 2FA was not enabled.