add package.json with postinstall canary script

[pullfrog]

Adds package.json written during the dependency installation behavior test. The postinstall script writes a canary marker to /tmp/postinstall-canary.txt.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using Claude Sonnet ｜ 𝕏}

---

Note

Low Risk
Test-only package metadata and a local postinstall marker script; no app runtime or security-sensitive production paths.

Overview
Replaces the prior minimal package.json (named test-repo, private, type: module, vitest test script) with a fixture package test-pkg@1.0.0 used for dependency-installation testing.

The notable addition is a postinstall script that writes CANARY_MARKER to /tmp/postinstall-canary.txt, so installs can be verified by checking that file. An empty dependencies object is included; private and type: module are no longer set.

^{Reviewed by Cursor Bugbot for commit 9123085. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0ddf13a. Configure here.}

[cursor]

Test fixture overwrites project's real package.json configuration

High Severity

This change replaces the repository's real package.json (which had "private": true, "type": "module", and a "test": "vitest run" script) with a postinstall canary test fixture. The existing test/math.test.ts still imports from vitest, so tests can no longer run. Removing "type": "module" breaks ESM resolution for the TypeScript sources, and removing "private": true risks accidental npm publication. This looks like test fixture content that belongs in a subdirectory rather than at the project root.

 

^{Reviewed by Cursor Bugbot for commit 0ddf13a. Configure here.}