Upgrade smithers-orchestrator to smthrs

[roninjin10]

Note: upstream SocketDev/socket-cli rejected cross-repo pull request creation (permissions), so this PR is opened on the fork instead.

The npm package smithers-orchestrator has been renamed to smthrs (no compatibility alias is published under the old name). This PR migrates socket-cli's pinned fleet tooling to the new package, bumping 0.23.0 → 0.33.0.

Changes

• scripts/fleet/setup/external-tools.json: repository npm:smithers-orchestrator → npm:smthrs, version 0.23.0 → 0.33.0, refreshed SRI integrity (verified against the npm registry's published dist.integrity for smthrs@0.33.0), and updated soakBypass dates for the new publish date (2026-08-02, removable 2026-08-09).
• scripts/fleet/setup/lib/install-smithers.mjs: tarball URL now points at https://registry.npmjs.org/smthrs/-/smthrs-<version>.tgz; doc comment updated.

Breaking-change migration applied

0.33.0's only relevant breaking change is the package rename itself; it was applied in metadata and the installer URL. The CLI binary name remains smithers, and the tarball entrypoint is still src/bin/smithers.js, so the shim logic is unchanged.

Verification

• git grep smithers-orchestrator is clean.
• external-tools.json parses as valid JSON.
• The committed integrity hash matches the npm registry's value for smthrs@0.33.0, and the tarball entrypoint matches the shim's expectation.
• No package.json dependencies or lockfile entries referenced the old package, so no lockfile change was required.

Reviewer note from the upgrade pipeline: "Upgrade is mergeable. The legacy package name is absent, the diff is limited to the required package rename/version migration, JSON and files are intact, smthrs 0.33.0 is published, and its registry integrity and tarball entrypoint match the committed values."

🤖 Generated with Claude Code