Fix npm 12 pack result handling

[nembal]

What changed

• Normalize both supported npm pack JSON contracts: npm 11 one-element arrays and npm 12 package-keyed objects.
• Reuse the fail-closed parser in the package audit and release exact-tarball resolver.
• Exercise the real pack and resolver flow under npm 11 and npm 12.0.2.
• Bump the package to 0.1.1 so the failed immutable v0.1.0 release tag is not reused.

Root cause

Release run 30725617777 destructured npm pack output as an array. npm 12.0.2 emits an object keyed by package name, so the workflow failed before publish even though the tarball was valid.

Validation

• npm 12.0.2 npm ci
• npm run lint
• npm test: 140 passing
• npm run typecheck
• npm run build
• npm run contracts:check
• package audit under npm 11.16.0 and npm 12.0.2; identical SHA-256 and clean-install smokes passed
• actionlint 1.7.12 on CI and release workflows
• git diff --check