Discover executable nested npm programs without leaking skipped candidate paths

Native package command discovery silently skips executable programs under lib/node_modules/*/bin on the pinned Zig0.17 toolchain and leaks each skipped candidate path. This blocks the maintained public nested-program and relocation acceptance for #268.

Observed while running the public createPackageSymlinks filesystem regression with real executable wrapper/resource fixtures. Original retained /tmp/pantry-268-relocatable-green.log reports12pass/1fail, missing activation and two allocator leaks, before any discovery repair. It is an existing discovery defect separate from provider/version activation ownership.

Owning source: packages/zig/src/install/symlink.zig, discoverNpmBinaries. It allocates full_path, then checks io_helper.statFile(full_path).mode & 0o111. io_helper.statFile intentionally supplies mode=0 when the compiler's stat type has no mode field, as on qualified Zig0.17. The function does not release full_path on the non-executable branch. Existing io_helper.isExecutable owns executable detection across supported platforms.

Acceptance:

• Reproduce through public discoverBinaries using a real managed package directory with executable and non-executable files in a nested npm-style bin directory. Require exactly the executable command and allow the testing allocator to detect any skipped-path leaks.
• Use the existing executable predicate and release each rejected candidate allocation. Preserve error ownership and returned BinaryInfo ownership; no fabricated mode values, scan bypass, alternate layout or package-specific override.
• Rerun public package activation across revisions, nested providers/programs, alternate routes, relocation and old-version removal. Keep the original failing nested acceptance rather than deleting or weakening it.
• Keep this source repair in a distinct commit from #268, complete owner checks and independent review, then publish and verify through the normal source/release flow before closing.

Native child of and blocker for #268. No released installer rerun, profile execution, manual shim rewrite or cache deletion was used to diagnose it.

Closing the nested discovery source leaf. Its distinct 31f84482 is included unchanged in release159. The public executable/non-executable filesystem regression plus exhaustive allocation-failure checks pass; the original missed-command/leak red remains retained. The complete17-case public activation suite preserves nested revision/provider/root/relocation/removal and sourceable-interface contracts. Final integrated Zig42/42steps with2014/2030passes and16existing skips,858TS tests, types/Pickier and independent Spec/Standards reviews pass. No fabricated stat mode, scan bypass or package-specific path was added.

Required exact-source159 Main CI41447621606, Releaser41447621136 and Deploy41447621420 all succeeded on eafe53d87d16df291afcce45d8ae6ad7a775d8d9. All14 required source jobs, seven native release builds, actual npm publication/readback and deployment are retained. The separate standalone Zig run was cancelled by normal concurrency after unrelated newer main852a0612; it is explicitly not counted passing. No gate, test or deadline was changed or bypassed.

Independently qualified all7 original public native ZIPs/manifest and actual npm159 payload: tag/source bindings, API sizes/digests, safe members/CRCs, accepted SHA1/SHA512, full1,865-file npm inventory and SLSA payload source/subject/run association. No independent cryptographic Sigstore-chain claim. Qualification /tmp/pantry-159-qualification/qualification-proof.json, SHA2560682e5766fe3e7b1d737f73d018e75ea6e3a1d02ae089d631683c8f1cf247e85.

The normal156self-upgrade selected159. Its actual installed9,040,328-byte DarwinARM64 executable hashes to 597a927c30dc663721e40c9a4f7438aed578520210cb6e28521ecadc5db4439b, exactly the verified public159 member, and reports pantry 0.11.159 (eafe53d87). Then the unchanged ordinary pantry install --user craft@0.0.423.1 completed successfully from the existing cache. All three previously stale auxiliaries now select423.1; the primary remains correctly selected. All4 actual selected Mach-Os equal their original upstream423 signed bytes, pass strict OS signature verification with DeveloperID3JJRNQW6B7/hardened runtime/JIT entitlement, and each normal bare command returns423with exit0.

Normal acceptance /tmp/pantry-159-normal-activation/craft-423.1-normal-installer-acceptance.json, SHA2569cf56f3c0c83083055f9d17fbfba6e92f7001e4524bee444459bc14656436664. No manual shim edits, deleted cache, force flag, PATH overlay, substitute runtime or profile fallback was used. This is signed program delivery/activation acceptance, not native game, replay/persistent-frame, physicalGPU or Gold fidelity acceptance. Linux runtime-provider #266 and downstream framework/application adoption remain separate.