fix(ci): unblock repeatable release acceptance

[pallyoung]

What changed

• compare logical npm package contents when an immutable CLI version already exists
• ignore only tar container metadata while verifying every packaged path, byte hash, size, type, link target, and executable bit
• reuse the existing registry candidate only after the content comparison passes
• launch the external-sidecar acceptance page in an independent Edge browser instead of unsupported Electron CDP page creation
• add package archive comparison and workflow boundary tests

Why

A release retry rebuilt identical product sources into a tarball with different archive-level integrity, blocking safe reuse of npm's immutable 0.5.9 candidate. The Full Desktop matrix also revealed that Electron's CDP endpoint does not support Target.createTarget; an independent system browser is the correct security boundary for the external sidecar scenario.

Verification

• pnpm exec vitest run --config scripts/vitest.config.ts scripts/verify-desktop-installed-update.test.ts scripts/validate-cli-package.test.ts scripts/github-workflows.test.ts --environment node
• pnpm exec biome check scripts/validate-cli-package.ts scripts/validate-cli-package.test.ts scripts/github-workflows.test.ts scripts/verify-desktop-installed-update.ts
• pnpm ci:typecheck:strict
• pnpm changeset:validate
• npm pack path behavior checked against @spencer-kit/coder-studio@0.5.9