fix(tests): make tarball verification portable on Windows (#752)

[debugmcpdev]

📋 Description

GNU tar on Windows Git Bash interprets the C: prefix in an absolute archive path as a remote host, causing the packaged skill/manifest assertion to fail. Invoke tar through execFile from the archive's parent directory, passing ./<basename> as an explicit argument. This also preserves spaces and literal filename characters without shell expansion.

Add integration coverage using a real archive for absolute and relative paths, packaged entries and archive size, and missing-archive rejection. The integration project runs in the existing Ubuntu and Windows CI jobs.

Fixes #752

🔄 Type of Change

• 🐛 Bug fix
• 🧪 Test improvement

✅ Checklist

• Code follows the project's style guidelines and has been reviewed locally
• The Windows path handling has an explanatory comment
• Regression tests added; the literal-filename cases failed before the fix and pass afterward
• Full local Dev-Loop Gate passed through the pre-push hook
• Privacy, documentation consistency, and changelog checks passed
• Documentation and changelog entries are unnecessary for this test-only change; the changelog gate confirms the exemption

🧪 Testing

The normal pre-push hook passed all required steps:

• pnpm run lint
• pnpm run typecheck:all — zero test type errors
• npm run clean && npm run build
• npm run test:unit — 5,376 passed
• npm run test:integration — 62 passed, 5 skipped

Additional validation passed:

pnpm exec vitest run --project integration tests/integration/cli/package-contents.test.ts
pnpm exec vitest run --project e2e tests/e2e/npx/npx-smoke-python.test.ts -t 'ships the agent skill and the pi manifest in the tarball'
pnpm run check:all-personal-paths
pnpm run check:docs
pnpm run changelog:check

Test configuration: Ubuntu 24.04.5 LTS, Node 22.22.3, Python 3.12.3, GNU tar 1.35.

📝 Additional Notes

Windows Git Bash validation has not been performed locally. The regression will run in Windows CI, using whichever tar is on that runner's PATH.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!