fix(npm): absolute cache root, per-arch cache dir, SIGINT during install

From a second Codex review (gpt-6.1-sol, xhigh):
- A relative XDG_CACHE_HOME (invalid per the XDG spec) made the launcher
  look for, and run, a binary under the current directory, which an
  untrusted checkout could supply. Use it only when absolute.
- The cache dir now includes <platform>-<arch>, so a home directory shared
  across machines cannot hand an arm64 host an x64 binary.
- SIGINT sent to the launcher's PID alone during the first-run install is
  forwarded to the installer (it was ignored); the launcher exits 130.
- npm smoke runs the first-run install with an empty user cache and checks
  the package binary was created, so a cached binary cannot pass for it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh

docs/NPM_DISTRIBUTION.md

@@ -54,8 +54,9 @@ its own npm 12, which is how 0.3.1 broke there (issue #41).
 
 The binary goes in the package's `bin/`, or, when that is not writable (a
 root-owned `sudo npm install -g` whose postinstall npm 12 skipped), in a
-per-user cache: `$XDG_CACHE_HOME`, else `~/.cache` (`~/Library/Caches` on
-macOS), under `<package>/<version>/`. The launcher looks in both. A
+per-user cache: `$XDG_CACHE_HOME` (if absolute), else `~/.cache`
+(`~/Library/Caches` on macOS), under `<package>/<version>/<platform>-<arch>/`.
+The launcher looks in both. A
 termination signal during that first-run download stops the installer too,
 and it removes its partial file.