fix: force fresh dist for release packages

[chubes4]

Summary

• force a complete TypeScript emit when assembling release artifacts so ignored incremental build state cannot preserve stale compiled runtime code
• exercise readonly staging and invalid-UTF-8 binary fallback directly from both packaged CLI distributions
• simulate an up-to-date incremental build with a poisoned mount-materialization.js before packaging to prove release assembly replaces stale dist

Root cause

The installed CLI reported the current package version because --version reads packages/cli/package.json, while its ignored compiled dist could predate the source changes from #1797. Release assembly called the ordinary incremental tsc -b; when .tsbuildinfo considered the project current, TypeScript could leave a stale or externally replaced dist file untouched and package it under current metadata.

The source protection from #1797 was therefore insufficient at the release boundary: stageReadonlyPlaygroundMounts and the invalid-UTF-8 base64 fallback were correct in source, but package startup/version checks did not prove those behaviors existed in the shipped JavaScript.

Regression coverage

tests/release-package-coverage.test.ts now:

• establishes valid incremental metadata, poisons the compiled mount-materialization module, and runs release packaging
• loads the runtime module from both the WordPress plugin ZIP and standalone CLI tarball
• verifies readonly WOFF2-like bytes remain unchanged after the staged mount is overwritten
• verifies MO-like invalid UTF-8 bytes bypass the Playground text writer and reach the PHP fallback as exact base64

Verification

• npm run test:playground-readonly-mounts passed
• npx tsx tests/mount-materialization.test.ts passed
• npm run build passed
• npm run test:playground-readonly-mounts-integration passed
• npm run test:release-package-coverage passed
• git diff --check passed

Fixes #1998.

No release, deploy, or merge was performed.