ci(npm): enforce canonical package author

[bytemain]

Summary

• set the approved jiacheng <jiacheng@botiverse.dev> author object on every publishable npm package in the Hands workspace
• add a repository-wide source metadata gate with negative contract tests
• verify the packed package/package.json before CLI, Node SDK, or Electron SDK publication
• publish Node/Electron from the exact verified tarball instead of repacking the directory after the check

Scope

Publishable npm packages only: @botiverse/hands-cli, @botiverse/hands-node, @botiverse/hands-electron, and @botiverse/hands-feedback-react. Private workspace packages and the independent OHPM recovery remain unchanged.

Verification

• metadata gate tests: 3/3 PASS, including missing/string/partial/drifted author negatives
• repository inventory: 4/4 publishable manifests PASS
• actual packed tarballs: 4/4 embedded package manifests PASS
• missing-author packed tarball: rejected as expected
• Node SDK tests 13/13 + build PASS
• CLI tests 32/32 + build PASS
• Electron tests 3/3 + build PASS
• Feedback React tests 32/32 + build PASS
• git diff --check PASS

No package was published and no deployment/runtime state was changed.

[bytemain]

Independent exact review of 0784708630fc7951212955c571ab897cabcfd07f: changes requested.

The four current publishable manifests, four independently packed tarball manifests, exact author value, and the CLI/Node/Electron same-tarball publish wiring all check out. Two release-gate gaps remain:

1. .github/workflows/check-npm-package-metadata.yml:35-38 only runs helper tests and source --all; scripts/verify-npm-author.test.mjs never invokes the production --tarball path at scripts/verify-npm-author.mjs:40-57,80-84. A broken archive extraction, entry lookup, JSON parse, or CLI dispatch can therefore merge green and fail only during an actual release. Add committed good-tgz and missing/drifted-author tgz CLI fixtures, and execute them in this PR check.
2. .github/workflows/check-npm-package-metadata.yml:5-12,15-22 enumerates only the three existing publishers, and no gate discovers every workflow containing npm publish. A future publish-feedback-react.yml (the fourth publishable package already exists) could be added without triggering this check and could publish from a directory/repack path. Use a publish-workflow glob for triggering and add a mechanical publisher closure asserting pack path -> --tarball verification -> both dry/real npm publish consume that exact path.

No package publish/deploy/runtime action was performed. I will re-review only a fresh exact head.