test: prove the packed registry installs and runs

[lmcorbalan]

Summary

Closes #161.

Adds npm run smoke:registry, the npm counterpart of npm run smoke: it packs the repository, installs the tarball into a scratch consumer outside it, and runs the bin that install links. No participant and no Daml toolchain.

Changes

• scripts/registry-install-smoke.sh: asserts the five archive entries, then runs the bin unconfigured and against a closed port. Both npm calls hold their own exit status and print what npm wrote, because --silent and a bare command substitution each swallow the diagnostics for the failures likeliest here (a compile error in prepare, an install that cannot reach the registry).
• package.json: one smoke:registry script entry.

Acceptance criteria

• All eight from Prove the published package installs and runs #161 are met. Every assertion is pinned by a mutation, including four the issue's own list does not reach.

Test plan

Thirteen runs (a green baseline, eleven faults expected red, one expected green) executed under npm 9.2.0 and npm 10.9.9, all thirteen correct under both. The npm version is load bearing: since npm 10, npm pack runs prepare in the foreground and writes to stdout, which made an earlier draft of this script fail on every good pack and discard the compiler's output on a bad one, so the name is read from the last line of a captured stdout instead. A spec that ships but does not parse is caught only by the /info request; a missing archive entry only by the listing. A files entry that drops registry/dist is caught at the bin run rather than the listing, since npm always packs the file bin points at. Interrupted mid-run, the temp directory and the server are both gone. shellcheck clean, npm run check:deps green.

Breaking changes

None. The check cannot prove the root manifest is complete: express is a peer dependency of express-openapi-validator, so npm installs it at the consumer's top level and the service runs whether or not the root names it. npm run check:deps covers that comparison, and the script's header says so.