refactor(authoring): share private npm acquisition verifier

[777genius]

Private dual-product candidates need acquisition that binds the expected product, source revision, version, mode and executable digest before returning a cached binary. This change extracts the existing verifier primitives and adds an explicit private adapter with the same per-target lock for warm and cold acquisition, repeated byte verification, owned cleanup and rollback error reporting.

The default bootstrap retains its metadata selection and delegates shared verification. The adapter accepts the existing private candidate mode only. Detached packages, launchers and public activation remain separate dependent work.

Stacked on #165. Verifier checkpoint: 6f3ef8633a41e8fcf7598f1f833787cae46a376a. Current integration e65ed6737fa8156029bfcdeef6707fa5838c2d16 includes staging base e707ca59501812f8ef6f259e699305c8aead9d32; npm source is unchanged by that merge. New native CI is pending. The unresolved Windows concurrency gate remains a merge hold.

Validation: the integrated bootstrap, private adapter and verifier suites passed 111 tests with zero failures or skips. Independent review found one valid Content-Length compatibility regression. The bounded correction accepts matching decimal lengths with leading zeroes and retains safe size, syntax and digest checks. After correction, the complete seven-suite regression passed 153/153 tests on each of Node 22.23.1 and 24.18.0. The integrator reviewed the correction and reran the affected integrated suites. Payload execution and private packed-wrapper E2E are not proved by these acquisition tests.

The private cache contract assumes cooperating processes and a quiescent namespace controlled by the same user. It does not claim protection from a hostile process under that identity or crash durability.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: e36b77f9-564c-43f4-becf-76f6886e0f02

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}