feat: resolve npm sources via npm pack

[kreneskyp]

What landed

resolveSource now resolves { type: "npm" } sources. An npm source is
npm packed and extracted under <cacheRoot>/npm/<key>, and the resolved
published version acts as the durable sha pin (mirroring a git sha), with
the requested version echoed back as ref. Exact-version pins are served
from the npm cache; unpinned / range specs re-fetch every resolve to honor
"latest". Both the existing GitRunner and a new NpmFetcher are injectable so
tests run with no real git/npm.

New public exports (barrel src/index.ts): type NpmFetcher, defaultNpmFetcher.
npmPackArgs is intentionally kept internal to resolve.ts (not re-exported).

Why it stalled before

The repo enforces a 100% coverage gate. The real defaultNpmFetcher runs
npm pack + tar, and its version ? pkg@version : pkg / --registry argv
branches are network-only — unreachable from an offline test, so the gate
failed and the work never landed.

Fix: extract a pure, exported npmPackArgs(spec, destDir) helper so the
version + registry branches are covered by a fast offline unit test (TC-025),
plus an offline integration test that npm packs a local folder through the
real defaultNpmFetcher (TC-024) and through resolveSource with no injected
fetcher (covers the ?? defaultNpmFetcher fallback). Coverage is back to 100%
on branches/functions/lines/statements.

Spec backsync

The clean origin/main spec said npm was unsupported; it now matches the code:

• FR-004 — npm resolution behavior, defaultNpmFetcher paragraph, CON-1
  reworded to "per-source package-manager subprocess" (git for git; npm pack +
  tar for npm), AC-3 narrowed to url-only, new AC-8..AC-11.
• NFR-003 — side-effect wording covers npm pack + tar; the zero-git
  settled-reconcile guarantee is kept intact.
• spec.md — §2.1/§2.2 (npm in scope, only url deferred), §3 + module table
  (resolve.ts gains NpmFetcher/defaultNpmFetcher/npmPackArgs), §8 source
  table + pinning (npm resolved version = the sha pin), §10 (UnsupportedSourceError
  = url only).
• tests.md — TC-007 retitled url-only; new TC-022..TC-025 mapped to
  FR-004-AC-8..AC-11; coverage rows, error-path table, and summary counts updated.

Concurrent-PR reconciliation note

TC-022..TC-054 is a shared TC-ID block also claimed by the concurrent
feat/plugin-discovery PR. This PR lands first and uses TC-022..TC-025 for
npm resolution; the two matrices will be reconciled at the second merge so
the IDs don't collide (noted in spec/tests.md).

Gates

• tsc --noEmit: clean
• vitest run: 27 passed
• coverage: 100% branches / functions / lines / statements
• eslint + prettier: clean
• quire validate: 0 errors (pre-existing EARS warnings on NFR-001/StR-002 only)

🤖 Generated with Claude Code

[kreneskyp]

Added a security hardening commit (3984df6): normalizeSource now rejects an npm package beginning with -, closing the new npm pack argument-injection sink this PR introduces (same second-order-command-line-injection class CodeQL flagged on the pre-existing git argv). FR-004-CON-3 + TC-026 added; coverage stays 100%.

The 3 CodeQL alerts currently shown are pre-existing git argv injections in resolve.ts:20/:77 on main (not introduced here) — those will be addressed in a separate hardening PR.