fix(npm): absolute cache root, per-arch cache dir, SIGINT during install

From a second Codex review (gpt-6.1-sol, xhigh):
- A relative XDG_CACHE_HOME (invalid per the XDG spec) made the launcher
  look for, and run, a binary under the current directory, which an
  untrusted checkout could supply. Use it only when absolute.
- The cache dir now includes <platform>-<arch>, so a home directory shared
  across machines cannot hand an arm64 host an x64 binary.
- SIGINT sent to the launcher's PID alone during the first-run install is
  forwarded to the installer (it was ignored); the launcher exits 130.
- npm smoke runs the first-run install with an empty user cache and checks
  the package binary was created, so a cached binary cannot pass for it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh

scripts/install.js

@@ -23,13 +23,19 @@ const binaryName = process.platform === "win32" ? `${nativeBinary}.exe` : native
 // (a root-owned global install whose postinstall npm 12 skipped), in a
 // per-user cache. scripts/idx.js looks in both, in this order.
 const packageBinaryPath = path.join(packageRoot, "bin", binaryName);
+// A relative XDG_CACHE_HOME is invalid per the XDG spec, and would make the
+// launcher run a binary from the current directory: ignore it.
+const xdgCacheHome = process.env.XDG_CACHE_HOME;
 const cacheBinaryPath = path.join(
-  process.env.XDG_CACHE_HOME ||
-    (process.platform === "darwin"
+  xdgCacheHome && path.isAbsolute(xdgCacheHome)
+    ? xdgCacheHome
+    : process.platform === "darwin"
       ? path.join(os.homedir(), "Library", "Caches")
-      : path.join(os.homedir(), ".cache")),
+      : path.join(os.homedir(), ".cache"),
   packageName,
   packageManifest.version,
+  // A home directory shared across machines must not mix architectures.
+  `${process.platform}-${process.arch}`,
   binaryName,
 );
 const binaryLocations = [packageBinaryPath, cacheBinaryPath];