fix(ruvector): verify-dist guards package.json entrypoints (#376)

[ruvnet]

Summary

• Closes npm package fails to import in 0.2.23 because published tarball is missing dist/index.js #376 — ruvector@0.2.23 was published with main: dist/index.js declared but the file absent from the tarball, so any consumer doing require('ruvector') or await import('ruvector') crashed on a fresh install.
• The current 0.2.25 tarball already ships dist/index.js (so end users on the latest release are not affected). This PR adds the regression guard that would have stopped the broken 0.2.23 publish in the first place.

Why this PR is still needed

scripts/verify-dist.js was added after #399 but only audits the require('../dist/...') calls inside bin/cli.js. It never looked at package.json#main, so a regression on the package's library entrypoint would slip through again.

Fix

• Audit package.json#main, types, module, and every bin.* entry against fs.existsSync under the package root.
• Run a require('<main>') smoke check as a final step. Skippable with VERIFY_DIST_SKIP_SMOKE=1 for emergency publishes.
• Keep the existing cli.js scan untouched.

Proof

Passing run on the current 0.2.25 working tree:

$ node scripts/verify-dist.js
verify-dist: 13 dist path(s) referenced by bin/cli.js present.
verify-dist: 3 package.json entrypoint(s) present.
verify-dist: require('dist/index.js') smoke OK.

Simulating the original #376 regression (rename dist/index.js away):

$ mv dist/index.js dist/index.js.bak
$ node scripts/verify-dist.js
verify-dist: package would publish broken:
  - 1 dist file(s) referenced by bin/cli.js are missing:
    - dist/index.js
  - 1 package.json entrypoint(s) point at missing files:
    - main → dist/index.js
exit code: 1

End-to-end pack of the current 0.2.25 tarball into a clean /tmp dir:

$ npm pack
ruvector-0.2.25.tgz

$ tar -tzf ruvector-0.2.25.tgz | grep dist/index
package/dist/index.js
package/dist/index.d.ts.map
package/dist/index.d.ts

$ node -e "import('ruvector').then(m => console.log('keys:', Object.keys(m).slice(0,5).join(',')))"
keys: ASTParser,AdamOptimizer,AdaptiveEmbedder,CodeGraph,CodeParser

Test plan

• Guard passes on the current good state of the package.
• Guard fails (exit 1) when dist/index.js is removed (simulated npm package fails to import in 0.2.23 because published tarball is missing dist/index.js #376).
• Tarball produced by npm pack actually contains dist/index.js.
• Both ESM import() and CJS require() work against the packed tarball.
• VERIFY_DIST_SKIP_SMOKE=1 honored as an emergency escape hatch.

🤖 Generated with claude-flow