add package.json with postinstall canary script

[pullfrog]

Adds package.json written during the dependency installation behavior test. The postinstall script writes a canary marker to /tmp/postinstall-canary.txt.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using Claude Sonnet ｜ 𝕏}

---

Note

Low Risk
Test-fixture-only change to package.json scripts; no production, auth, or data-handling impact.

Overview
Reworks package.json into a minimal test package (test-pkg) whose postinstall script writes a canary marker to /tmp/postinstall-canary.txt.

Removes the previous vitest script, private/type fields, and adds an empty dependencies block for dependency-install behavior testing.

^{Reviewed by Cursor Bugbot for commit c6979bb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Test fixture overwrites project's real package.json configuration

High Severity

This change replaces the repository's real package.json (which had "private": true, "type": "module", and a "test": "vitest run" script) with a postinstall canary test fixture. The existing test/math.test.ts still imports from vitest, so tests can no longer run. Removing "type": "module" breaks ESM resolution for the TypeScript sources, and removing "private": true risks accidental npm publication. This looks like test fixture content that belongs in a subdirectory rather than at the project root.

 

^{Reviewed by Cursor Bugbot for commit 0ddf13a. Configure here.}