test(spm): cover sync-spm-autolinking, generate-spm-package, download helpers

Raise unit-test coverage of the SPM toolchain:

- sync-spm-autolinking.js (0% -> ~86%): extract pure decideSyncPlan() and
  make main(argv, deps) accept injectable collaborators (real impls as
  defaults), so the orchestration is testable end-to-end without jest.mock.
- generate-spm-package.js (~30% -> ~94%): make the zero-i header composer
  injectable into main(); add tempdir tests for the happy path, the composed
  layout branch, the exit-1 error paths, and auto-detect.
- download-spm-artifacts.js (~11% -> ~35%): widen exports and unit-test all
  pure / fetch-stubbable helpers (URL builders, snapshot + npm dist-tag
  resolution, release->snapshot fallbacks, cache validation, findFirst,
  extractXCFramework, format helpers). The remaining HTTP-streaming and
  download/processArtifact/main orchestration is left untested by design.

Tests use the existing dir conventions (real tempdirs + globalThis.fetch
stubbing, no jest.mock). 391 spm tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: chrfalch