test: CI addon artifact smoke 연결

[JeremyDev87]

변경 내용

• native package smoke가 CI에서 방금 npm pack한 현재 플랫폼 addon tarball을 root package consumer install에 사용하도록 연결했습니다.
• raw native library 재패킹 경로와 CI-produced artifact 경로를 구분하는 회귀 assertion을 추가했습니다.

이유

기존 native smoke는 동일 바이너리를 다시 임시 패키징해 설치하므로, CI가 생산한 addon tarball이 root optional dependency 경로에서 실제로 사용되는지는 증명하지 못했습니다.

검증

• KRATOS_PACKAGE_SMOKE_NATIVE_LIB=target/release/libkratos_node.dylib KRATOS_PACKAGE_SMOKE_ADDON_TARBALL=<staged tarball> node --test test/package-smoke.test.js
• npm run verify
• cargo test --workspace
• cargo clippy --workspace --all-targets
• git diff --check
• workflow YAML parse

경계

• version bump, tag, npm publish, release workflow/provenance policy 변경은 포함하지 않습니다.
• remote native five-target CI는 이 PR의 현재 head에서 확인해야 합니다.

Closes #93

[JeremyDev87]

Hermes Independent Review — approve

• current head: e48a47650dad88a073c75c5a16aa2de3ef8d2b28
• scope: CI-generated current-platform addon tarball is now the artifact installed through the packed root package consumer smoke.
• evidence: current-head CI run 29499466492 is 10/10 terminal success, including five Native Packaging lanes (Windows, macOS arm64/x64, Linux arm64/x64), each completing Smoke root package with current native addon. Local staged-tarball smoke, npm run verify, cargo test --workspace, cargo clippy --workspace --all-targets, and git diff --check also passed.
• review: blocker findings 0. The environment value is a repository-local GITHUB_WORKSPACE path plus the prior addon_pack step output; no untrusted event/input context is introduced. Missing verify:workflow-lint and verify:security-posture npm scripts are baseline repository capability gaps (same on master), not this PR's failing checks.
• boundary: this is a self-review evidence comment, not branch-protection approval. Version/tag/npm publish/release-policy changes and merge/auto-merge were not performed.

HERMES_REVIEW_APPROVE