ci: publish checksummed package artifacts

[blckbx]

Summary

• run the documented install, test, build, validation, and pack sequence after changes reach main
• generate and verify a SHA-256 checksum for the npm tarball
• upload the tgz and checksum as a commit-specific workflow artifact
• document checksum verification and protect the CI contract with a metadata test

Validation

• npm test: 187 tests passed
• npm run build
• npm run package:validate
• npm run package:dry-run
• npm run audit
• npm pack plus sha256sum verification
• npm run ci passed through packed-artifact smoke testing; the local install smoke requires Node 22.22.3 while this workspace has 22.22.1, and GitHub Actions uses 22.22.3