feat(codelldb): per-platform npm packages as optionalDependencies (esbuild pattern) - #393

…build pattern)

Closes #383. CodeLLDB now ships as five platform packages —
@debugmcp/codelldb-{win32-x64,darwin-x64,darwin-arm64,linux-x64,linux-arm64}
— declared as optionalDependencies of @debugmcp/mcp-debugger, so npm
installs exactly the one matching the host os/cpu. Rust and C/C++
debugging work out of the box on every platform npm serves, and the CLI
tarball shrinks from ~54 MB to ~2 MB (it previously bundled linux-x64).

- Platform packages are payload shells versioned by the CodeLLDB release
  (1.11.8): committed manifest/README/LICENSE only, binaries staged at
  pack time by scripts/stage-codelldb-packages.mjs from the digest-pinned
  VSIXs (--verify guards against publishing a near-empty package). The
  win32 package allows cpu arm64 (x64 emulation; no upstream arm64 build).
- Resolver: new platform-package candidate probed after the four vendor
  candidates and before CODELLDB_PATH, via createRequire so it works from
  the inlined npx bundle; monorepo dev resolution stays vendor-tree-first
  (codelldb-common deliberately declares no platform-package dependency).
- Release: staging + token-first-publish steps in release.yml (guarded by
  npm-view at the CodeLLDB version, tagged latest explicitly), pack/
  provenance lists extended, release-dry-run checks the five against the
  vendor-manifest pin, sync-versions skips codelldbPlatform-marked
  packages, prepare-pack resolves optionalDependencies.
- Tests: resolver candidate-order coverage, package.json drift guards,
  plain-node hermeticity probe, self-gating rust npx smoke (arms after
  first publish), npm install -g retry with --omit=optional in the npx
  harness for the pre-publish window.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…idempotency, drift guards

Review follow-ups on the platform-packages PR:

- Resolver precedence: the installed @debugmcp/codelldb-* package is now
  the LAST resort — vendor tree, then CODELLDB_PATH, then the package —
  so an explicit env override survives the upgrade (three reviewers
  flagged the silent shadowing). The require.resolve walk is lazy and
  memoized per platform dir; getCodeLLDBVersion reads version.json as a
  sibling of the binary it actually resolved before falling back to the
  candidate walk (no more cross-install misattribution).
- Release idempotency: the platform-package publish guard distinguishes
  E404 from transient npm-view failures ("already exists" is the normal
  path at an unchanged pin — a hiccup must not publish over an existing
  version and kill the job); the token .npmrc is removed via an EXIT trap;
  staging and --verify-only run as separate processes so a silently-dying
  vendor process cannot vouch for itself (#389 coupling).
- One source of truth: stage-codelldb-packages.mjs derives platforms and
  payload layout from the vendor script's exported PLATFORMS, drops its
  duplicate freshness check (downloadAndExtract already has one), stages
  in parallel, uses a single failure channel, and extends exec-bit checks
  to lldb/bin helpers (warning loudly on a Windows staging host, where
  NTFS cannot represent them). sync-versions.cjs now WRITES the
  vendor-manifest pin into any workspace package declaring os/cpu — a
  CodeLLDB bump is just "edit manifest + DEFAULT_CODELLDB_VERSION, run
  sync" — replacing the codelldbPlatform marker field, which is dropped.
- Drift guards: new tests pin release.yml's and release-dry-run.sh's
  five-platform lists to SUPPORTED_CODELLDB_PLATFORM_DIRS, assert every
  declared os/cpu combo maps back through getCodeLLDBPlatformDir (the
  win32-arm64 emulation contract), and forbid an exports map on the
  payload shells (it would break the resolver's package.json resolve).
  Platform-package READMEs no longer hardcode the CodeLLDB version.
- Test hygiene: the npx install retry now fires only on E404/ETARGET
  naming @debugmcp/codelldb-* (any other failure stays loud); the rust
  npx smoke imports the real resolver helpers instead of private copies
  and timeboxes its collection-time registry probe; dry-run command
  substitutions fail as red checklist lines instead of aborting under
  set -e; bundle-cli's default is '' (the 'none' sentinel remains as the
  explicit escape hatch).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>