Use generated tarballs instead of pack stdout

[iwizsophy]

Summary

pnpm 10 adjusted how lifecycle script output is displayed, and pack stdout can now include prefixed log lines such as > before the JSON result.

Our previous implementation relied on parsing pack stdout to determine the generated tarball path, which made the flow fragile and caused JSON parsing failures when lifecycle output was mixed in.

This change makes the pack flow rely on the actual generated artifacts instead of stdout parsing.

Changes

• stop using pack stdout as the source of truth for the tarball path
• inspect pack-destination after a successful pack
• use the tarball only when exactly one *.tgz file exists
• fail explicitly when no tarball is generated
• fail explicitly when multiple tarballs are generated
• add regression tests for misleading stdout content and pack destination edge cases

Testing

• npm exec vitest run tests/cli-nullability.test.ts
• npm exec vitest run tests/cli.test.ts

[iwizsophy]

Additional reproduction note:

We reproduced this specifically with pnpm pack --json when lifecycle hooks (prepack / postpack) were present. In that case, stdout contained lifecycle log lines before the JSON payload. Without lifecycle scripts, stdout was plain JSON in our check.

That makes stdout parsing fragile even if the final JSON payload itself is still produced.