fix(chrome): launch the packaged CLI entrypoint in npm installs (#2146)

* fix(chrome): launch the packaged CLI entrypoint

* fix(chrome): harden install verification

* fix(chrome): verify installed setup targets

* fix(chrome): harden setup receipt verification

* test(chrome): require the packaged heap-limit helper

A packed tarball that has every other required entry but not
package/bin/heap-limit.mjs must fail clean-install verification.

.github/workflows/install-hygiene.yml

@@ -45,7 +45,8 @@ jobs:
         with:
           bun-version-file: .bun-version
 
-      # The verify script only uses node builtins + scripts/externalsValidation
-      # (relative import) — no bun install needed, keeping the matrix cheap.
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
       - name: Verify published package installs clean
         run: bun run scripts/verify-clean-install.ts --published