Restore bundled CLI permissions before publishing npm archives

Artifact downloads strip executable modes. Restore both Unix CLI modes before packing, then smoke-test the actual npm archive and its native addon and CLI. The current 0.51.1 archive fails this check before the permission repair and passes afterward; the published npm version is immutable.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

Author: Tim

.github/workflows/publish.yml

@@ -105,6 +105,12 @@ jobs:
       - name: Install dependencies (skip build — we have prebuilts)
         run: npm install --ignore-scripts
 
+      - name: Restore bundled CLI permissions
+        run: chmod 755 prebuilds/linux-x64/doltlite prebuilds/darwin-arm64/doltlite
+
+      - name: Smoke test npm archive
+        run: node scripts/test-package.js
+
       - name: Verify npm publish identity
         run: |
           npm config get registry

scripts/test-package.js

@@ -0,0 +1,37 @@
+"use strict"
+
+const assert = require("node:assert/strict")
+const fs = require("node:fs")
+const os = require("node:os")
+const path = require("node:path")
+const { execFileSync } = require("node:child_process")
+
+const root = path.resolve(__dirname, "..")
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "doltlite-package-"))
+
+try {
+  const packed = JSON.parse(execFileSync("npm", [
+    "pack", "--ignore-scripts", "--json", "--pack-destination", tmp,
+  ], { cwd: root, encoding: "utf8" }))
+  execFileSync("tar", ["xzf", path.join(tmp, packed[0].filename), "-C", tmp])
+  const packageRoot = path.join(tmp, "package")
+  for (const platform of ["linux-x64", "darwin-arm64"]) {
+    const cli = path.join(packageRoot, "prebuilds", platform, "doltlite")
+    assert.notEqual(fs.statSync(cli).mode & 0o111, 0, `${platform} CLI is not executable`)
+  }
+  const { DatabaseSync, binPath } = require(packageRoot)
+  const db = new DatabaseSync(":memory:")
+  try {
+    assert.equal(db.prepare("SELECT doltlite_engine() AS engine").get().engine, "prolly")
+    db.exec("CREATE TABLE t(id INTEGER PRIMARY KEY); INSERT INTO t VALUES(1)")
+    assert.equal(db.prepare("SELECT count(*) AS n FROM t").get().n, 1)
+  } finally {
+    db.close()
+  }
+  assert.equal(execFileSync(binPath(), [":memory:", "SELECT doltlite_engine();"], {
+    encoding: "utf8",
+  }).trim(), "prolly")
+  console.log("npm archive: native addon and executable bundled CLIs PASS")
+} finally {
+  fs.rmSync(tmp, { recursive: true, force: true })
+}