fix(pkg): remove the archive size caps from the npm, PyPI and Go wrappers

[DeusData]

Fix: the package wrappers can install the release again (#2657)

Thank you @hydroplexus for the precise report in #2657.

v0.12.0 cannot be installed through npm, pnpm, pip or the Go wrapper on any
platform: each wrapper refuses an archive member above 256 MiB, and every
v0.12.0 binary is 331-335 MB (linux-amd64 331.4, linux-arm64 332.2,
darwin-arm64 334.8, windows-amd64 333.7). The v0.11.0 binaries were already
~300 MB, so the Go wrapper (capped since v0.10.0) was broken before; npm and
PyPI gained the cap in v0.12.0 (52ab4e5). install.sh, install.ps1,
Homebrew, Scoop and winget have no such cap and were never affected.

What changes

• Wrappers (pkg/npm/install.js, pkg/pypi/.../_cli.py,
  pkg/go/.../main.go): every byte-size cap is gone (compressed archive, per
  member, aggregate, checksum manifest, download size). The archive is still
  verified against the release's checksums.txt before it is unpacked, the
  member set must be exact, paths and links are refused, the member count is
  bounded, every hop is HTTPS, and the binary must answer --version.
• Test override: all three honour CBM_DOWNLOAD_URL exactly like
  install.sh: https://..., or plain http:// to an exact loopback
  authority, then with no proxy and no redirect. Anything else is refused.
• Install-path smoke: scripts/smoke-wrappers.sh installs the npm (packed
  tarball, global install, postinstall), PyPI (venv + pip) and Go (build)
  wrappers from the checkout against the release fixture and runs the binary
  each one installed. smoke-test.sh Phase 13w runs it on every venue;
  SMOKE_REQUIRE_WRAPPERS=1 makes it required (a missing toolchain fails) on
  the PR smoke lanes and in the release smoke, which gates the release draft
  and publishing.

Other install paths (checked channel by channel)

• Homebrew: the formula was still at 0.10.3 and installed the
  dynamic Linux build, which needs glibc 2.38 (fails on Ubuntu 22.04,
  Debian 12, RHEL 9). It now installs 0.12.0 with the static -portable
  Linux assets (hashes from the release's checksums.txt) and is a
  release surface in the version contract, so it moves with every release.
• Go: go install .../pkg/go/cmd/codebase-memory-mcp@v0.12.0 fails
  ("module source tree too large"): there are no pkg/go/v* tags, so Go
  fetches the whole repository. @latest builds main's wrapper, whose
  version constant lags (it installs 0.11.0). The release now also pushes
  pkg/go/vX.Y.Z, and the wrapper installs its own module version (from
  debug.ReadBuildInfo; the constant only for local and untagged builds).
• npm next: still pointed to 0.9.1-rc.1; a stable release now also
  moves next to itself (idempotent, release CI token).
• Docs: winget and Chocolatey were advertised but never published
  (manifests/d/DeusData is 404; no community package); removed from the
  README, the site and llms.txt until they are. Windows arm64 ships and
  is now listed.
• Unaffected: install.sh / install.ps1, Scoop (official bucket at
  0.12.0), the MCP registry, the .mcpb bundles, Glama/Docker, and
  update (it hands off to the install scripts). AUR is community-maintained
  (0.11.0). npm 12 blocks install scripts by default; the launcher then
  downloads on first run, which works once the caps are gone.

Proof on the shipped artifact

Loopback fixture with the real v0.12.0 darwin-arm64 archive (334.8 MB
binary) and the release's checksums.txt:

wrapper	v0.12.0 (ec6427c)	this PR
npm (global install of the packed tarball)	exceeds the 268435456-byte expanded safety limit	checksum verified, ready, runs codebase-memory-mcp 0.12.0
PyPI (venv + pip)	same refusal	runs codebase-memory-mcp 0.12.0
Go (built wrapper)	same refusal (on its own v0.11.0 download)	runs codebase-memory-mcp 0.12.0

Unit suites: npm 20 pass / 3 Windows-only skips, PyPI 45 pass, Go
go vet + go test ./... ok.

Not in this PR

• Publishing to winget and Chocolatey (needs the maintainer's accounts).
• The orphaned in-repo AUR files (pkg/aur, 0.8.1); the published AUR
  packages are community-maintained.