add package.json with postinstall canary script

[pullfrog]

Adds package.json written during the dependency installation behavior test. The postinstall script writes a canary marker to /tmp/postinstall-canary.txt.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using Claude Sonnet ｜ 𝕏}

---

Note

Low Risk
Test-only manifest change; postinstall only touches a local temp marker file and is not production runtime code.

Overview
Replaces the prior minimal package.json (Vitest test script, test-repo name) with test-pkg @ 1.0.0 aimed at install-time testing.

Adds a postinstall script that writes CANARY_MARKER to /tmp/postinstall-canary.txt so automated checks can confirm lifecycle hooks run during dependency installation. dependencies is left empty.

^{Reviewed by Cursor Bugbot for commit 75c96d4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0ddf13a. Configure here.}

[cursor]

Test fixture overwrites project's real package.json configuration

High Severity

This change replaces the repository's real package.json (which had "private": true, "type": "module", and a "test": "vitest run" script) with a postinstall canary test fixture. The existing test/math.test.ts still imports from vitest, so tests can no longer run. Removing "type": "module" breaks ESM resolution for the TypeScript sources, and removing "private": true risks accidental npm publication. This looks like test fixture content that belongs in a subdirectory rather than at the project root.

 

^{Reviewed by Cursor Bugbot for commit 0ddf13a. Configure here.}