Publish Rainier CLI beta via npm

[jiashuoz]

Summary

• Publish @tokencanopy/rainier@0.0.3 for npx and global installation, with beta tag.
• Dependency-free Node 22+ wrapper downloads immutable macOS/Linux ARM64/x64 binaries, verifies pinned archive/binary hashes, and atomically caches them.
• Preserve terminal streams, literal arguments, exit status, and termination signals; add install documentation and make npm-test.

Publication

Public package: https://www.npmjs.com/package/@tokencanopy/rainier/v/0.0.3
The registry tarball matches the tested artifact byte-for-byte. Registry metadata confirms version 0.0.3 and beta tag; npm also automatically assigned latest on first publication. Source commit: fc3468e.

Verification

• Full make verify passed: Go tests, builds, public-contract checks, vet.
• All 11 npm tests pass on macOS ARM64 and Linux ARM64/x64 (Node 22).
• Packed artifact contains exactly six allowlisted files, no dependencies or lifecycle scripts.
• Real npx download/execute and isolated global install with ignore-scripts passed on macOS ARM64; packed npx execution passed on Linux x64.
• Linux ARM64 first-use download/execute and Linux x64 cached execution with network disabled passed.
• Fresh public-registry package-name npx invocation and direct-tarball invocation passed.
• Main independently reran controlling-PTY test: raw input, resize, detach, and exit passed.

Reviews and boundaries

Independent review: no findings; all four archive and binary pins checked.
Adversarial review: no blockers or should-fixes; checked download bounds/redirects, extraction integrity, cache symlinks/concurrency, injection, stdin/EOF, exit codes/signals, and controlling-PTY behavior.
No Go source, backend, or existing release assets changed. No live remote coding session was exercised for this distribution-only change. Windows, proxy configuration, and managed-cloud general availability remain out of scope. PR intentionally remains open, not merged.