Fix npm 12 first-publish compatibility

[Wibias]

Why

The first manual npm bootstrap publish exposed two release-path issues that CI had not covered:

• npm 12 changed npm pack --json from the pre-12 array shape to a keyed object shape, causing scripts/validate-npm-package.mjs to parse the wrong slice and fail locally.
• npm publish normalized the package metadata and reported the github-delivery bin entry as invalid/removed, which would break the public npx github-delivery entrypoint if published that way.

Changes

• normalize bin.github-delivery to scripts/github-delivery-cli.mjs
• normalize repository.url to npm's documented git+https://... form
• add a shared npm-pack JSON parser accepting both npm <=11 array output and npm 12 keyed-object output
• use that parser in the package validator and tarball tests
• add an explicit regression for both npm pack JSON shapes

Release boundary

Do not publish the bootstrap or tag v0.5.0 until this PR is green and merged. The prior failed npm publish --tag bootstrap returned E403 before publication, so no package version was released by that attempt.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.