test(contracts): align the release contracts with the single-composition layout

Caught by running the contracts rather than by inspection:

- package-release.sh built its archives from an ARCHIVE_MEMBERS array, which
  only ever existed to append a UI pack conditionally. With a fixed four-file
  inventory the array hides the member list from the very contract that is
  supposed to pin it, so the members go back inline on the archive call.
- test_windows_bundle_contract.sh asserted the pypi wrapper exposes
  _windows_binary_ready(). That function became _runtime_set_ready() when the
  wrapper locks were reworked; the contract now asserts the current API, since
  the property it guards is "resolves the single Windows binary", not a name.
- test_smoke_fixture_contract.sh required smoke-local.sh to emit both a
  variant-suffixed archive and a standard alias. There is one archive name now,
  so it asserts that instead -- and that ${SUFFIX} is gone entirely, so the
  alias machinery cannot quietly return.

Verified on the built artifact: the binary runs, carries 9 shebangs, 1
node:child_process and 14 hook-augment references (the deliberately inverted
property), and contains zero references to cbm-integrations.json, CBMUIPK or
--verify-runtime-assets.

Contract status on macOS: build_dir_safety, makefile_ts_runtime_dependencies,
parallel_harness, security_fuzz_harness, security_strings_allowlist,
soak_daemon_recovery, spawn_no_window, ui_dev_proxy_security, venue_parity,
vm_worktree_manifest, windows_bundle, smoke_fixture, vt_gate_policy and
vt_release_notes all pass. hook_conflict_notice, parent_watchdog and
worker_error_response fail for the documented environmental reasons (TEST_SEAMS
build seam, and the developer's own installed daemon holding the version
cohort), not from this change.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

scripts/package-release.sh

@@ -183,21 +183,14 @@ if [ "$GOOS" = "windows" ]; then
     (
         cd "$PACK_DIR"
         rm -f "$OUT_DIR/$NAME.zip"
-        ARCHIVE_MEMBERS=(
-            codebase-memory-mcp.exe LICENSE install.ps1
-            THIRD_PARTY_NOTICES.md
-        )
-        zip -q "$OUT_DIR/$NAME.zip" "${ARCHIVE_MEMBERS[@]}"
+        zip -q "$OUT_DIR/$NAME.zip" \
+            codebase-memory-mcp.exe LICENSE install.ps1 THIRD_PARTY_NOTICES.md
     )
     echo "=== package-release: $OUT_DIR/$NAME.zip ==="
 else
-    ARCHIVE_MEMBERS=(
-        codebase-memory-mcp LICENSE install.sh
-        THIRD_PARTY_NOTICES.md
-    )
     # BSD tar otherwise materializes macOS extended attributes as hidden
     # AppleDouble `._*` members, violating the exact four-file inventory.
     COPYFILE_DISABLE=1 tar -czf "$OUT_DIR/$NAME.tar.gz" -C "$PACK_DIR" \
-        "${ARCHIVE_MEMBERS[@]}"
+        codebase-memory-mcp LICENSE install.sh THIRD_PARTY_NOTICES.md
     echo "=== package-release: $OUT_DIR/$NAME.tar.gz ==="
 fi

tests/test_smoke_fixture_contract.sh

@@ -137,15 +137,15 @@ for relative, source in (
 # Unix fixtures mirror the release archive surface and Linux update aliases.
 for name in ("LICENSE", "install.sh", "THIRD_PARTY_NOTICES.md"):
     require(name in smoke_local, f"smoke-local.sh archive must include {name}")
+# One composition ships, so there is one archive name and no variant alias.
 require(
-    "codebase-memory-mcp${SUFFIX}-${OS}-${ARCH}.tar.gz" in smoke_local
-    and "codebase-memory-mcp-${OS}-${ARCH}.tar.gz" in smoke_local,
-    "smoke-local.sh must create the selected variant and standard alias",
+    "codebase-memory-mcp-${OS}-${ARCH}.tar.gz" in smoke_local
+    and "${SUFFIX}" not in smoke_local,
+    "smoke-local.sh must create the single canonical archive with no variant alias",
 )
 require(
-    "codebase-memory-mcp${SUFFIX}-${OS}-${ARCH}-portable.tar.gz" in smoke_local
-    and "codebase-memory-mcp-${OS}-${ARCH}-portable.tar.gz" in smoke_local,
-    "smoke-local.sh must create Linux portable selected-variant and standard aliases",
+    "codebase-memory-mcp-${OS}-${ARCH}-portable.tar.gz" in smoke_local,
+    "smoke-local.sh must create the Linux portable update alias",
 )
 require(
     'CBM_CACHE_DIR="$WORK_DIR/cache"' in smoke_local

tests/test_windows_bundle_contract.sh

@@ -216,7 +216,7 @@ single_binary_contracts = {
     ),
     "pkg/pypi/src/codebase_memory_mcp/_cli.py": (
         r"_WINDOWS_BINARY_NAME\s*=\s*['\"]codebase-memory-mcp\.exe['\"]",
-        r"def\s+_windows_binary_ready\(",
+        r"def\s+_runtime_set_ready\(",
     ),
 }
 for relative, patterns in single_binary_contracts.items():