The npm branch adds a file, so the tarball differs from the tag of the same
name. Leaving that to be discovered is how a supply-chain question becomes an
unanswerable one; a -npm tag says exactly which tree was published.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>