fix(packages): put every wrapper and its tests on the same base

Restoring files from two different pre-revert commits left the package wrappers
internally inconsistent, and one of them did not compile. Found by actually
building and running them rather than by grepping for removed symbols.

pkg/npm — bin.js was never restored, so main's version was destructuring
runtimeSetReady/acquireRuntimeLock out of an install.js restored from an older
base that does not export them. `npx codebase-memory-mcp` would have died at
require time on Windows. install.js, bin.js and the launcher test now all sit on
the pre-externalization base, where installWindowsBinaryAtomically is the right
primitive for publishing exactly one file. The runtime-set locking that goes
away with it existed only to publish binary+sidecars atomically.

pkg/go — main.go kept the Windows lock work while main_test.go had been reverted
past it, so the package did not build at all:
  main.go:805: no new variables on left side of :=      (my edit dropped uiPack)
  main_test.go: undefined: windowsPayloadName           (reverted past its removal)
The test is back on main's base, keeping every lock-race test from #1495/#1496
(TestRuntimeSetLock*, TestExpiredLease*, TestStalledRuntimeLockCreator*,
TestRuntimeSetLockSerializesProcesses). Dropped 19 whose premise -- a multi-file
runtime set with content-addressed sidecars -- no longer exists, and reduced the
writeTestRuntimeSet/assertRuntimeTag helpers to the single file that now ships.

pkg/pypi — same base repair, keeping the lock and orphan-reconciliation tests.
The three archive-SAFETY tests (hardlink members, symlink metadata, unexpected
root member) were ADAPTED rather than dropped: they only named a removed file in
their fixtures, and they guard traversal properties that still matter.
test_release_archives_require_the_integrations_sidecar is inverted rather than
deleted -- asserting the sidecar is ABSENT is the stronger guard, since a
returning sidecar is exactly what broke `pip install` on Windows.

Verified: go vet + go build + go test ok; pypi 24 tests OK; npm 10/10;
Windows single-binary bundle contract still passes.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

Author: DeusData

pkg/go/cmd/codebase-memory-mcp/main.go

@@ -35,9 +35,9 @@ import (
 )
 
 const (
-	repo                 = "DeusData/codebase-memory-mcp"
-	version              = "0.8.1"
-	windowsBinaryName    = "codebase-memory-mcp.exe"
+	repo              = "DeusData/codebase-memory-mcp"
+	version           = "0.8.1"
+	windowsBinaryName = "codebase-memory-mcp.exe"
 
 	maxRedirects            = 5
 	requestTimeout          = 2 * time.Minute
@@ -802,8 +802,7 @@ func extractTarGzWithLimits(
 	if err != nil {
 		return nil, err
 	}
-	err := validateArchiveMemberNames(names, archiveNames, false)
-	if err != nil {
+	if err := validateArchiveMemberNames(names, archiveNames, false); err != nil {
 		return nil, err
 	}
 	runtimeNames := append([]string(nil), extractNames...)
@@ -948,8 +947,7 @@ func extractZipWithLimits(
 		names = append(names, name)
 		declaredSizes[name] = declaredSize
 	}
-	err := validateArchiveMemberNames(names, archiveNames, true)
-	if err != nil {
+	if err := validateArchiveMemberNames(names, archiveNames, true); err != nil {
 		return nil, err
 	}
 	runtimeNames := append([]string(nil), extractNames...)