release blocker: remove the build-machine path from the craft-native CJS bundle

Problem

A current-main bun pm pack of craft-native contains the build machine absolute path in dist/index.cjs:

/Users/glennmichaeltorregosa/Documents/Projects/craft/packages/typescript/src

It comes from getSdkVersion() joining import.meta.dir with ../package.json. The CJS build targets Node, so Bun folds import.meta.dir to the source directory at build time. In an installed consumer package, the code tries to read package.json from the developer machine path, catches the failure, returns unknown, and silently disables the SDK/native version mismatch warning added for #236.

The ESM build preserves import.meta.dir and is relocatable under Bun; the Node-targeted CJS artifact is affected.

Reproduction

bun run --cwd packages/typescript build
rg "/Users/|/home/runner" packages/typescript/dist
bun pm pack --dry-run

The absolute path appears in the shipped CJS payload. A clean tarball extraction/import confirms the path is retained.

Expected

• Resolve the package version in a format-neutral, relocatable way for both ESM and CJS (for example, inject the version as a build-time constant rather than injecting a directory).
• Add a CJS consumer test that proves the actual package version is used by the mismatch probe.
• Add a package verification that rejects common absolute build paths in shipped JavaScript and source maps.
• Confirm all npm tarballs contain no secrets, environment files, private keys, or developer/runner absolute paths.

The broader secret scan found no credentials, env files, private keys, source-map absolute paths, or other developer paths. This single CJS path was the only concrete leak.

Discovered during the post-merge release audit for #254, #242, and #220; do not publish the next npm release with this artifact.