feat(npm): prepare shared public authoring launchers

[777genius]

The public npm launchers cannot consume the engine-bound dual-authoring release. Add one shared acquisition adapter for both fixed products, strict metadata/cache verification, and exact preparation packs containing the actual public launchers.

Preparation packs remain private and unqualified: ordinary launch rejects before effects. Protected public staging, authenticated native qualification and publishing remain the next slice. Preserve historical v1/v2 behavior, package scripts, Node minima and kit postinstall. Reuse existing verifier, canonical archive parser and private packing primitives.

Stacked on #170 (070663e). Reuses three exact producer files from #196 at 3e3386f; no workflow imports. Current diff: 1,690 changed lines, including 462 exact imported lines and the redirect regression fix.

Validation of writer bytes committed as 635e056:

• 72 focused verifier/public-runtime/public-pack tests passed, no skips. Local fixture tarballs exercised actual public bins, cold/warm cache, postinstall, signals and peer-preserving uninstall/reinstall using structural executables and transport-only fixtures.
• 27 imported structural producer tests passed; focused Go npm package contract passed.
• All source/artifact hashes and patch checks passed. Independent exact-commit review found one P2: cancellation through an incompletely drained redirect can reject before the active destination closes. Reproduced with the real HTTP parser over an in-memory Duplex, without a network listener. Fixed in f68c25d and accepted by independent exact-commit review: 76 focused tests passed; four regressions fail against the exact parent and pass on the fix, with two supplemental active-error cases passing.
• Exact-source f68 E2E built all 12 native assets and verified both projections, then failed the actual public preparation CLI: allowlist is not iterable. Main calls prepare before exporting ALLOWLIST, and the public closure reader observes the partially initialized module. No npm packs were produced and public native execution did not run. Terminal artifact SHA256SUMS verification passed. Fixed by 64cba1d: initialize exports before CLI entry. Independent review accepted both files/all 69 changed lines; matching-commit fresh CLI regression and 62 focused tests passed without skips. Actual preparation/native evidence for this successor remains pending; old f68 artifacts are not relabeled. Node 18 remains unproved.
• Current f68 source-acquisition and polyglot smoke passed on both OS lanes. Native checks remain failing; Linux requires the missing packed-native input. Existing ci(authoring): require native and packed acceptance #172 mandatory packed wiring and an explicit public evidence intake are being integrated separately, without dropping required coverage.

Synthetic qualification fixtures prove acquisition/execution behavior only, not signatures or publication readiness. No packages/tags were published. This does not complete Phase 6 or the full authoring plan. Main integration, supported-platform checks and subsequent authenticated publishing gates remain.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}