verify: npm Node package smoke from clean env

[DecisionNerd]

Objective

Prove the public Node binding works from a clean npm installation.

Acceptance criteria

1. A clean environment installs @curatelabs/graphforge@0.5.0 from public npm without a repository checkout or local addon.
2. The documented smoke scenario loads the native addon and returns the expected Arrow result.
3. Evidence records platform, architecture, Node/npm versions, command, resolved package version, and outcome.

Relationships

• Parent: post-release: v0.5.0 clean-env verification and follow-up #167
• Blocked by: release: publish v0.5.1 Node binding, CLI, and skills #198 and release: publish v0.5.1 documentation #197

[DecisionNerd]

Evidence path (blocked until publish)

Lane: npm in the CurateLabs/graphforge-legecy#2795 harness (PR CurateLabs/graphforge-legecy#2822).

• Docs/map: docs/development/clean-environment-verification.md
• Local: python3 scripts/ci/clean-env-verify.py run --version 0.5.0 --lane npm ...
• CI: workflow_dispatch Clean Environment Verify after public registries have 0.5.0

Blocked on #198 (via CurateLabs/graphforge-legecy#2794). Preflight today fails closed — registries do not yet publish 0.5.0. Do not check off without real install/URL/checksum evidence.

[DecisionNerd]

Clean-env evidence (npm + CLI) — PASS

Version disposition: Issue titles name v0.5.0. Public registries show v0.5.0 as an incomplete surface (PyPI + @curatelabs/graphforge only; no CLI/skills/crates). The first complete coordinated surface is v0.5.1, and the current public release is v0.5.2. Clean-env verification was executed against 0.5.2 from public registries (not local RC artifacts), matching the intent of post-release proof after #192/#194–#198 closed.

Note: @curatelabs/graphforge@0.5.0 exists; CLI starts at 0.5.1. Verified complete surface 0.5.2.

AC mapping

1. Clean env installed @curatelabs/graphforge@0.5.2 from public npm.
2. Smoke loaded native addon and returned expected Arrow result (npm-smoke-ok 0.5.2).
3. Also verified CLI: npm install @curatelabs/graphforge-cli@0.5.2 → graphforge 0.5.2.
4. Evidence recorded below.

Environment: macOS-26.6 arm64; Python 3.14.6; Node v24.16.0; npm 11.13.0
Harness: python3 scripts/ci/clean-env-verify.py run --version 0.5.2 ...
Evidence: build/clean-env-evidence-0.5.2.json schema graphforge-clean-env-evidence-v1, overall ok: true, generated_at 2026-08-07T15:45:02+00:00, sha256 75bdc396388b8d47787e64f584df3f73fcf2203be9bab605303801a78aa3f6a2
Release record: GitHub Release asset v0.5.2-digest.json (graphforge-release-candidate-v2, commit c2b782cd833d54aa14bb097b69bd23f3c2a93a9b), sha256 9dc019016e3cf0d8f456638f3e87d45b3de3fab5d252c9218efcd04f9d0e1aaf
PRs: URL-lane harness #429