Release 0.2.2: fix the ESM entry and smoke-test packed consumers in PR CI

[asiridalugoda]

Objective

import('@helixar_ai/hdp') fails for every ESM consumer of 0.2.1 with ERR_MODULE_NOT_FOUND, on Node 20 and 22. The ESM build imports ajv/dist/2020 without a file extension, and ajv has no exports map, so Node's ESM resolver cannot find the file. require() is unaffected. The same failure reaches @helixar_ai/hdp-mcp and @helixar_ai/hdp-autogen, which load the core. The release smoke test already saw this and recorded it as a known failure, so 0.2.1 shipped with it.

Change

• Fix. src/schema/validator.ts imports ajv/dist/2020.js. Both the CommonJS and ESM builds resolve it, and the type declarations are unchanged. A scan of every published package's ESM output found no other extensionless deep imports.
• Smoke test. .github/scripts/smoke-npm-release.sh treats a failed ESM import as a failure. The known-failure path is removed.
• PR CI. A new job in ci.yml runs the same packed-consumer smoke test on Node 20 and 22: it packs every npm package, installs the tarballs into an empty directory with fresh dependency resolution, then calls require() and import() on each. This class of defect now fails a pull request instead of a release.
• Versions. The four npm packages the v* tag publishes move to 0.2.2: @helixar_ai/hdp, @helixar_ai/hdp-mcp, @helixar_ai/hdp-autogen and hdp-validate. Python packages are unchanged and the tag does not publish them. json-canonicalize stays at exactly 2.0.0.

Verification

• With the old import, the strict smoke test fails on Node 22: ERR_MODULE_NOT_FOUND ... Did you mean to import "ajv/dist/2020.js"?. With the fix, all four packages pass require() and import() on Node 20 and 22, and the hdp-validate CLI runs.
• Root typecheck, build and tests; hdp-physical, hdp-mcp, hdp-cli and hdp-autogen-ts typecheck, build and tests; the seven Python packages' suites.
• None of the four packages has a 0.2.2 on npm yet.