feat(release): drive the installed entry from the packed tarballs

A throwaway consumer outside the repository declares every member as a file:
dependency, installs, and runs the installed executable with plain Node,
asserting the version it reports. That is the check a workspace link or a stale
lib/ in the checkout cannot pass for: it reads only what files selected.

The family declares its executable, so the vendored family — libraries a
consumer imports, with no executable — states that it has none instead of
carrying a probe that would prove nothing.

Both pack workflows run it after packing, still without credentials.

.github/workflows/release-vendor.yml

@@ -80,6 +80,9 @@ jobs:
       - name: Pack release tarballs
         run: pnpm run release:pack --family vendor --out dist/npm-vendor
 
+      - name: Verify packed install
+        run: pnpm run release:verify-packed-install --family vendor --from dist/npm-vendor
+
       - uses: actions/upload-artifact@v4
         with:
           name: vendor-npm-tarballs

.github/workflows/release.yml

@@ -79,6 +79,9 @@ jobs:
       - name: Pack release tarballs
         run: pnpm run release:pack --family dsh --out dist/npm
 
+      - name: Verify packed install
+        run: pnpm run release:verify-packed-install --family dsh --from dist/npm
+
       - uses: actions/upload-artifact@v4
         with:
           name: dsh-npm-tarballs