Verify a published npm CLI release against the real artifact

After publishing, don't trust the local checkout: install the exact version globally (npm i -g pkg@x.y.z, which also replaces an earlier npm i -g ./dir symlink), diff the installed bin against main, then exercise it end to end in a throwaway HOME (and tool homes like CODEX_HOME) pointed at a local API, plus run the installed hook scripts directly with real session payloads to check exit codes, latency and guard paths. Only tag the release after the registry tarball matches.