feat: pin wrapper runtime to packaged git metadata

[cafitac]

Summary

• pin the npm wrapper's delegated Python core to packaged git metadata when available, falling back to the existing unpinned GitHub source spec otherwise
• add prepack/postpack metadata generation so published tarballs include a wrapper gitHead without leaving the repo dirty after pack
• cover the behavior with wrapper tests and packed-tarball smoke checks, and document the new wrapper resolution behavior

Testing

• node --test test/npm-wrapper.test.cjs
• npm test
• npm pack --dry-run
• bash scripts/check-python.sh
• bash scripts/verify-ai-harness.sh
• packed wrapper smoke that unpacks the tarball and verifies buildCoreCommand(...).args[3] contains the packaged gitHead