test: gate packed CLI over TLS/WSS

[dzianisv]

Summary

• pack/install @vibebrowser/cli and run a deterministic TLS/WSS tool roundtrip through a transparent TLS proxy into the real relay agent endpoint and a separate fake extension
• prove discovery plus agent call_tool -> relay -> fake extension receipt -> extension tool_result -> exact CLI payload
• keep the public browser credential out of pull-request CI; run the exact published CLI version only in the trusted public-relay post-publish environment
• gate standalone CLI releases against the last npm-published CLI version and matching cli-v* tag, catching accumulated unversioned shared-source changes
• cover release trigger paths including tsconfig*.json and add 37 deterministic release/security regressions

Testing

• npm run build
• npx tsc --noEmit
• npm run validate:skill
• npm run check:cli-version
• npm run test:release-gates
• npm run test:e2e:cli-package
• VIBE_PUBLIC_CLI_VERSION=0.3.2 npm run test:e2e:cli-public-relay (clean skip without protected secret)
• npm run test:ci
• actionlint -ignore SC2129 .github/workflows/ci.yml .github/workflows/publish.yml

Fixes #131
Parent: #130

No real relay UUID is included in this PR, argv, artifacts, or test output. The PR is not merged.