fix(security): remove postinstall script, download binary on first run only

.claude/agent-memory/archgate-developer/MEMORY.md

@@ -66,7 +66,7 @@ Skipping steps 2 or 3 is a workflow violation. The user should NEVER have to inv
 
 ## Distribution / Packaging
 
-- **npm shim + GitHub Releases** — The npm package is a thin shim (`bin/archgate.cjs` + `scripts/postinstall.cjs`). On first run, the shim downloads the platform binary from GitHub Releases and caches it to `~/.archgate/bin/`. No platform-specific npm packages.
+- **npm shim + GitHub Releases** — The npm package is a thin shim (`bin/archgate.cjs`). On first run, the shim downloads the platform binary from GitHub Releases and caches it to `~/.archgate/bin/`. No platform-specific npm packages.
 - **`.cjs` extension is mandatory** — Root `package.json` has `"type": "module"`. Any Node.js CJS wrapper script placed at the package root MUST use `.cjs`, not `.js`, or Node.js will attempt to parse it as ESM and fail.
 
 ## Telemetry Strategy

CLAUDE.md

@@ -48,7 +48,7 @@ Zod schemas are the single source of truth. Types derived via `z.infer<>` — ne
 
 ## npm Distribution
 
-The npm package is a **thin shim** — it contains only `bin/archgate.cjs` and `scripts/postinstall.cjs`. The shim downloads the platform binary from GitHub Releases on first run and caches it to `~/.archgate/bin/`. All runtime dependencies (commander, inquirer, zod) are bundled into the compiled binary via `bun build --compile`, so they belong in `devDependencies`, not `dependencies`.
+The npm package is a **thin shim** — it contains only `bin/archgate.cjs`. The shim downloads the platform binary from GitHub Releases on first run and caches it to `~/.archgate/bin/`. All runtime dependencies (commander, inquirer, zod) are bundled into the compiled binary via `bun build --compile`, so they belong in `devDependencies`, not `dependencies`.
 
 ## Conventions
 

package.json

@@ -27,8 +27,7 @@
     "archgate": "bin/archgate.cjs"
   },
   "files": [
-    "bin/archgate.cjs",
-    "scripts/postinstall.cjs"
+    "bin/archgate.cjs"
   ],
   "os": [
     "darwin",
@@ -49,7 +48,6 @@
     "format:check": "oxfmt --check .",
     "knip": "knip",
     "lint": "oxlint --deny-warnings .",
-    "postinstall": "node scripts/postinstall.cjs",
     "test": "bun test --timeout 60000",
     "test:coverage": "bun test --timeout 60000 --coverage --reporter=junit --reporter-outfile=coverage/junit.xml",
     "test:watch": "bun test --watch --timeout 60000",

src/commands/adr/import.ts

@@ -3,7 +3,6 @@
 import {
   existsSync,
   mkdirSync,
-  readFileSync,
   rmSync,
   unlinkSync,
   writeFileSync,
@@ -37,11 +36,13 @@ import { ensureRulesShim } from "../../helpers/rules-shim";
 
 // ---------- Imports manifest I/O ----------
 
-function loadImportsManifest(projectRoot: string): ImportsManifest {
+async function loadImportsManifest(
+  projectRoot: string
+): Promise<ImportsManifest> {
   const importsPath = join(projectRoot, ".archgate", "imports.json");
   if (!existsSync(importsPath)) return { imports: [] };
-  const raw = readFileSync(importsPath, "utf-8");
-  return ImportsManifestSchema.parse(JSON.parse(raw));
+  const raw = await Bun.file(importsPath).json();
+  return ImportsManifestSchema.parse(raw);
 }
 
 function saveImportsManifest(
@@ -255,7 +256,7 @@ export function registerAdrImportCommand(adr: Command) {
 
         // --list: show previously imported ADRs
         if (opts.list) {
-          const manifest = loadImportsManifest(projectRoot);
+          const manifest = await loadImportsManifest(projectRoot);
           if (useJson) {
             console.log(formatJSON(manifest, opts.json ? true : undefined));
           } else if (manifest.imports.length === 0) {
@@ -392,7 +393,7 @@ export function registerAdrImportCommand(adr: Command) {
 
         // ---------- Update imports.json ----------
 
-        const manifest = loadImportsManifest(projectRoot);
+        const manifest = await loadImportsManifest(projectRoot);
         const sourceGroups = new Map<
           string,
           { version?: string; ids: string[] }