chore: update package.json for postinstall canary test

[pullfrog]

Updates package.json as part of the dependency installation behavior test — sets name, version, adds a postinstall canary script, and clears dependencies.

  ^{｜ via Pullfrog ｜ Using Claude Sonnet ｜ 𝕏}

---

Note

Medium Risk
Adds a postinstall script that writes to /tmp, which will execute automatically during installs and can affect CI/build environments. Other changes are limited to package metadata and removing the test script/dependencies.

Overview
Updates package.json to rename the package and add a version, and removes the previous test script/fields.

Adds a postinstall canary that writes CANARY_MARKER to /tmp/postinstall-canary.txt, and sets dependencies to an empty object.

^{Reviewed by Cursor Bugbot for commit b941043. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b941043. Configure here.}

[cursor]

Removing private: true risks accidental npm publish

Medium Severity

The "private": true field was removed from package.json without being mentioned in the PR description. This safety guard prevents accidental publication to the npm registry. Without it, running npm publish (even accidentally) could push test-pkg@1.0.0 to the public npm registry — potentially causing a supply-chain concern or namespace squatting. Since the package is a test fixture and not meant to be published, "private": true is worth keeping.

 

^{Reviewed by Cursor Bugbot for commit b941043. Configure here.}