fix: align npm installer with accepted Linux archive

[MelaBuilt-AI]

Summary

• Repin the unpublished Linux npm bootstrap to the unchanged accepted application archive from main 4bdb0cc6986ef87677c57da5499963fc78f67eb1.
• Update the real-archive source-identity assertion and package README to match SHA-256 d9ebb915087f61da953f12923bbd798a2c47549af34c670f3ffba7d17298fe98.
• Keep application bytes, version, runtime behavior and public-release gates unchanged. This is bootstrap alignment only; no app rebuild or binary upload.

Verification

• Independently hashed the delivered Linux archive and read its BUILD.json: expected source commit, sourceDirty false, bundled Node24.18.0.
• RED: accepted archive rejected with old embedded digest.
• GREEN: real-archive installation/source identity/repeat/bundled launcher invocation and wrong-digest refusal, 2 tests passed, 0 skipped.
• Node syntax check, scoped ESLint, repository-wide Prettier check and git diff --check passed.
• Real packaged npm exec/npx/pnpm dlx + generated-wrapper UI/API/WebSocket/quit proof will follow clean merged-source packing after merge approval. The unit's intentional invalid-port probe is not claimed as startup proof.

Boundaries

No npm publication, product tag/Release, download activation, global install, retained-state mutation, or rebuild of accepted installers. Existing same-version installs are not upgraded; private testing uses isolated installation/state roots. Application-source and bootstrap-source identities remain distinct.