fix(npm): absolute cache root, per-arch cache dir, SIGINT during install

From a second Codex review (gpt-6.1-sol, xhigh):
- A relative XDG_CACHE_HOME (invalid per the XDG spec) made the launcher
  look for, and run, a binary under the current directory, which an
  untrusted checkout could supply. Use it only when absolute.
- The cache dir now includes <platform>-<arch>, so a home directory shared
  across machines cannot hand an arm64 host an x64 binary.
- SIGINT sent to the launcher's PID alone during the first-run install is
  forwarded to the installer (it was ignored); the launcher exits 130.
- npm smoke runs the first-run install with an empty user cache and checks
  the package binary was created, so a cached binary cannot pass for it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh

scripts/npm-smoke.sh

@@ -88,9 +88,12 @@ echo "npm smoke: installing idx-mcp with --ignore-scripts"
 no_scripts_dir="${smoke_dir}/idx-mcp-no-scripts"
 npm_config_cache="$npm_cache" npm install --prefix "$no_scripts_dir" "${smoke_dir}"/idx-mcp/idx-mcp-*.tgz \
   --no-save --no-package-lock --no-audit --no-fund --ignore-scripts
-IDX_BINARY_URL="${repo_root}/target/release/idx-mcp" \
+# An empty user cache, so a binary cached by an earlier run cannot stand in
+# for the first-run install.
+XDG_CACHE_HOME="${smoke_dir}/no-scripts-cache" IDX_BINARY_URL="${repo_root}/target/release/idx-mcp" \
   "${no_scripts_dir}/node_modules/.bin/idx-mcp" --help > "${smoke_dir}/no-scripts-help.txt"
-if ! head -n 1 "${smoke_dir}/no-scripts-help.txt" | grep -q "MCP server"; then
+if ! head -n 1 "${smoke_dir}/no-scripts-help.txt" | grep -q "MCP server" \
+  || [[ ! -x "${no_scripts_dir}/node_modules/idx-mcp/bin/idx-mcp" ]]; then
   echo "npm smoke: idx-mcp without postinstall did not start cleanly:" >&2
   cat "${smoke_dir}/no-scripts-help.txt" >&2
   exit 1
@@ -104,7 +107,7 @@ chmod -R a-w "${read_only_dir}/node_modules/idx-mcp"
 XDG_CACHE_HOME="${smoke_dir}/user-cache" IDX_BINARY_URL="${repo_root}/target/release/idx-mcp" \
   "${read_only_dir}/node_modules/.bin/idx-mcp" --help > "${smoke_dir}/read-only-help.txt"
 chmod -R u+w "${read_only_dir}/node_modules/idx-mcp"
-cached=("${smoke_dir}"/user-cache/idx-mcp/*/idx-mcp)
+cached=("${smoke_dir}"/user-cache/idx-mcp/*/*/idx-mcp)
 if ! head -n 1 "${smoke_dir}/read-only-help.txt" | grep -q "MCP server" || [[ ! -x "${cached[0]}" ]]; then
   echo "npm smoke: idx-mcp with a read-only package did not install to the user cache:" >&2
   cat "${smoke_dir}/read-only-help.txt" >&2