test: accept npm 12 pack output

[anusbutt]

Outcome

Keep release package journeys compatible with both npm 10 and npm 12 JSON output.

npm 10 returns npm pack --json as a one-element array. npm 12 returns an object keyed by package name. A small shared test helper now accepts exactly one valid manifest in either shape while preserving every existing tarball-content and clean-install assertion.

No production, package content, schema, validator, hook, documentation, dependency, or version behavior changes.

Evidence

Before:

• npm 12 full release verification passed all 303 functional/security tests but both package E2E tests failed because their parser indexed the keyed object as an array.

After:

• Focused parser/package suite: 5/5 passed on npm 12.
• Full npm 12 release:verify: 306 functional/security tests passed, 2 package E2E tests passed, package smoke passed.
• Parser tests cover npm 10 arrays, npm 12 keyed objects, empty/multiple results, and missing filenames.

Checklist

• Tests cover both accepted output shapes and malformed boundaries.
• Package content and installation assertions remain unchanged.
• Production and schema behavior are untouched.
• No generated archive or unrelated edit is included.
• Publication and tagging remain paused pending merge and required CI.

Compatibility and recovery

This is test-harness compatibility only. It accepts npm 10 and npm 12 output without weakening the requirement that exactly one manifest with a filename is returned. No user recovery or repository migration is required.