BUG: release verifier dry-run suppresses nested npm pack tarball

[andrei-hasna]

Symptom

Running the package's real npm dry-run path from a clean release candidate fails
inside prepublishOnly:

HASNA_TODOS_EXPECTED_COMMIT=2200a65e8cd99f8a53801688a1d7f8ccc22dd414 npm publish --dry-run --access public

The lifecycle invokes:

bun run scripts/verify-public-release.ts --mode=publish

Its nested npm pack reports hasna-todos-0.15.9.tgz, but the outer npm
dry-run setting suppresses creation of that tarball. The verifier then fails:

Public release gate failed:
- payload-manifest: tar: .../hasna-todos-0.15.9.tgz: Cannot open: No such file or directory

Discriminating control

The same clean commit and publish authority succeed when the verifier is invoked
directly with the lifecycle and expected-commit contract:

HASNA_TODOS_EXPECTED_COMMIT=2200a65e8cd99f8a53801688a1d7f8ccc22dd414 \
npm_lifecycle_event=prepublishOnly \
bun run scripts/verify-public-release.ts --mode=publish

Result:

Public release gate passed (AUTHORITATIVE).

It built twice, produced identical packs and payload manifests, validated
provenance, installed the tarball in isolation, and reported todos --version
as 0.15.9.

This proves the package candidate is valid and isolates the failure to npm
dry-run propagation into the nested pack command.

Expected repair

• Ensure the release verifier or lifecycle wrapper creates a real isolated pack
  artifact when invoked under npm publish --dry-run.
• Add a regression whose positive arm creates and extracts the tarball.
• Keep a negative control that still rejects a genuinely missing artifact.
• Do not weaken the clean-tree, expected-commit, integrity, provenance, or
  install-smoke gates.

This is separate from the metadata-only 0.15.9 release candidate; no product
source change belongs in that PR.

Todos task: e8b9b8b6-c0ea-417a-b0fd-cb2631cf188b
Source release task: 53dc7968-de04-4716-b9be-4b495423e6d9