[sanskarIN]

Why

The CLI package currently passes source tests and a dry-run pack inventory, but we also need to prove that the actual packed npm tarball can be installed and executed across operating systems.

Changes

• Add npm run smoke:consumer: pack the actual CLI into a private .tgz, install that tarball into a fresh temporary prefix with npm install --offline --ignore-scripts and a private npm cache, then run the installed lineloom CLI.
• Check manifest identity/version, executable, help, version, stable and preview dry-runs, explicit --preview --publisher Sanskar dry-run and stable-channel migration rejection.
• Run packed-consumer verification on Windows, macOS and Linux package CI and immediately before owner-approved npmjs staging after the temporary npmjs registry manifest override. No actual VS Code extension installation, publishing or network fetch in the consumer smoke.
• Update CLI, npmjs publishing, QA and distribution documentation.

Real portability bug found by the new test

The first macOS CI run revealed the packed CLI produced empty output when launched through an OS path alias. Its ESM entrypoint compared import.meta.url to pathToFileURL(process.argv[1]), which can disagree for identical files when macOS canonicalizes /var to /private/var (or through an npm bin symlink).

• Fix bin/lineloom.mjs to compare realpathSync of the main script and resolved module file, preserving no side effects on ordinary imports.
• Add a regression test of canonical and symlink invocation paths (symlink assertion on Unix only; Windows is still verified via the real installed-package consumer smoke).

Gates

The CLI is still unpublished 0.3.0 development source. No npmjs staging, package version bump, GitHub release, VSIX upload, Marketplace/Open VSX publication or publisher migration. A packed tarball smoke is not physical-editor acceptance or independent public-registry install evidence. Merge only after all CI passes.