fix(build): add clean step so renames cannot leak stale files to npm

[sjsyrek]

Summary

Adds a clean step to the build so a file rename cannot leak stale compiled output into the published npm tarball. Closes the gap left by sync-1q8x, which was marked complete but never actually landed.

The bug, reproduced on main

tsc does not delete output for sources that no longer exist, and package.json ships dist/. So orphaned artifacts from any rename reach the tarball. Verified before the fix:

$ touch dist/sync/sync-strings.js dist/sync/strings-client.js
$ npm run build
$ npm pack --dry-run | grep strings
npm notice 0B dist/sync/strings-client.js
npm notice 0B dist/sync/sync-strings.js

Those filenames are exactly what the v1.1.0 squash-merge existed to keep off the public record.

The prior change was lost without trace — git log -S '"clean"' -- package.json returns no commits, so it was never committed despite the issue being closed "Completed in commit."

Changes Made

+ "clean": "rm -rf dist tsconfig.tsbuildinfo",
- "build": "tsc && chmod +x dist/cli/index.js",
+ "build": "npm run clean && tsc && chmod +x dist/cli/index.js",

• tests/unit/package-manifest.test.ts — new, 8 assertions pinning these invariants
• CHANGELOG.md — ### Changed entry under Unreleased

Why tsconfig.tsbuildinfo must go too

This is the non-obvious part, and the reason the naive fix fails. tsconfig.json sets "incremental": true. Deleting only dist/ leaves the 101 KB build-info file asserting the output is current, so tsc emits nothing and the build dies:

chmod: dist/cli/index.js: No such file or directory

So rm -rf dist on its own — which is what the original issue prescribed — breaks the build. That may well be why the earlier attempt disappeared.

Test Coverage

New tests/unit/package-manifest.test.ts covers:

• clean exists, and removes both dist and tsbuildinfo
• build runs clean first, and sets the bin exec bit
• prepublishOnly rebuilds
• files excludes *.tsbuildinfo and *.js.map
• bin targets resolve inside dist/

This change was silently lost once; a test makes a repeat impossible.

Verified on Node 24.18.0:

build from clean state    dist regenerated, bin exec bit set (-rwxr-xr-x)
planted stale files       no longer survive a rebuild
npm pack --dry-run        0 internal-name hits, 323 files, 197.4 kB
                          README + LICENSE present, 0 .map files
npm run lint              pass
npm run type-check        pass
npm test                  232 suites / 5501 tests passed

Backward Compatibility

✅ No runtime change — build tooling only; no source modified.
✅ Same published surface, minus stale artifacts.
⚠️ Builds are now always full, never incremental. tsconfig.tsbuildinfo is removed on every build, so the incremental cache no longer applies to npm run build. Measured cost is a few seconds; correctness of the published tarball is worth more. npm run type-check is unaffected and still incremental.
❌ Breaking changes: none.

Size: Small ✓

One script addition, one script edit, one new test file.