Add pre-publish artifact verification to catch broken files/exports,
wrong entry paths, or incorrect types resolution before 0.6.0 ships.
Runs as a dedicated verify-package job on Node 22 LTS (artifact check,
not runtime check) that needs the build matrix to succeed first.

- npm pack --dry-run: confirm tarball manifest is producible
- publint: lint package.json exports/main/module/types/files
- @arethetypeswrong/cli: verify TS consumers (node16/bundler) resolve
  working types for both CJS and ESM entrypoints

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Replace Array(48) + pad()/parseInt()/substr() chain with Buffer.alloc(48)
plus direct byte assignment and buf.writeBigUInt64BE for the origin and
transmit timestamps. Drops the now-unused pad() helper.

The new implementation splits the NTP 64-bit timestamp into whole seconds
and fractional seconds before combining via BigInt so the fractional
portion no longer loses low-order bits to the Number mantissa during the
legacy (seconds * 2**32) float round-trip.

acceptResponse previously validated only originTimestamp, leaving
transmitTimestamp, receiveTimestamp, and precision as non-null-asserted
in collectSamples. Add explicit undefined checks for those fields in
acceptResponse (throwing the same Format error pattern as existing
checks) so malformed replies are rejected before they become samples,
and drop the ! assertions in collectSamples. A guard in the forEach
provides type narrowing that is now backed by the validator.

The previous ordering registered client.once("message") inside the
send() callback, so an NTP reply that arrived after the packet was on
the wire but before Node fired the send callback would hit no listener
and be silently dropped; the caller would then wait the full
replyTimeout before rejecting. Attach the message listener up front and
keep hasFinished/timeoutHandler guards so the timeout, send errors, and
socket errors still short-circuit the promise correctly.

The retry counter only advanced when ntpResults was still empty, so any
partial success that produced fewer than numSamples usable packets
(e.g. one server responding, the rest persistently timing out) could
spin the do/while loop indefinitely because retry stayed at 0. Snapshot
the result count before each round and bump retry when the post-round
count is unchanged, keeping the existing retry < 3 cap.

Two related leaks: (1) dgram.send can throw synchronously when the
socket is in a bad state, and the throw was not caught, so the timeout
handler, UDP socket, and registered listeners all leaked and the
surrounding promise was never rejected; wrap the send call so we clear
the timeout, run NtpTimeSync.cleanup, and reject exactly once. (2)
NtpTimeSync.cleanup only called client.close(), leaving "message" and
"error" listeners attached on an abandoned socket where a late event
could still fire resolve/reject or prevent the process from exiting;
call client.removeAllListeners() before close().

Applies the open Dependabot update (#128, prettier 3.8.3 -> 3.9.3) and
bumps the ntp-packet-parser runtime dependency to 0.6.1. Verified with
unit + integration tests, publint, and attw.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

attw 0.18.2's `--pack` mode parses `npm pack --json` internally and
crashes ("Cannot read properties of undefined (reading 'filename')") on
the npm bundled with node 22.23.1 in CI, while publint's own pack of the
same tree succeeds. Pack the tarball ourselves and hand the .tgz to attw,
which bypasses the broken parser. Tarball is cleaned up and *.tgz is
already gitignored.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

@arethetypeswrong/cli 0.18.2 (core 0.18.2) decompresses the packed
tarball with a streaming Gunzip callback that keeps only the *last*
chunk. With fflate 0.8.3 (which CI resolves fresh since yarn.lock is
gitignored) the tarball is emitted in multiple chunks, so the untar
sees no data and attw crashes with "Cannot read properties of undefined
(reading 'filename')". core 0.18.3 fixed this to collect all chunks.

Reproduced on node 22.23.1 with a node_modules install; verified 0.18.4
passes under the same conditions. Reverts the earlier explicit-pack
workaround, which did not help since the bug is in extraction, not pack.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Three correctness fixes flagged during the pre-v0.6.0 review:

- recursiveResolveOptions rejected unknown options by iterating over the
  defaults, so the guard could never fire and typos were silently
  ignored. Iterate the caller's keys instead (and only recurse when both
  sides are plain objects). Unknown options now throw "Invalid option".

- Server parsing used server.split(":", 2), which mangles IPv6 literals
  (host became the first hextet, port NaN). Add parseServer() supporting
  bracketed IPv6 with optional port, bare IPv6 literals (host-only), and
  the existing host / host:port / IPv4[:port] forms, with port-range
  validation.

- Clock offset used ((|T2-T1| + |T3-T4|) / 2) * sign(T3>T4), which gives
  the wrong result when the inbound and outbound legs disagree in sign.
  Use the signed RFC 5905 formula ((T2-T1) + (T3-T4)) / 2.

Adds 10 tests (option validation, server parsing) plus an offset-sign
regression that fails against the old heuristic. BREAKING: unknown
options now throw, and computed offsets change for asymmetric paths.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>