Harden CLI tar archive metadata

.agents/manifests/implementation-foundation.yaml

@@ -11,6 +11,7 @@ globs:
   - scripts/package_local.sh
   - scripts/package_smoke.sh
   - scripts/test_app.sh
+  - scripts/validate_cli_tar.mjs
 owner: ios-dev
 required_skills:
   - apple-doc-research
@@ -36,6 +37,7 @@ allowed_paths:
   - scripts/package_local.sh
   - scripts/package_smoke.sh
   - scripts/test_app.sh
+  - scripts/validate_cli_tar.mjs
   - spec/**
   - .agents/**
 forbidden_paths: []

.agents/manifests/specs.yaml

@@ -54,6 +54,7 @@ allowed_paths:
   - Formula/**
   - packages/simbroker/**
   - scripts/package_cli.sh
+  - scripts/validate_cli_tar.mjs
   - scripts/package_cask_zip.sh
   - scripts/package_npm.sh
   - scripts/sync_homebrew_tap.sh

.github/workflows/ci.yml

@@ -1,6 +1,7 @@
 # Public Node test surface. GitHub-hosted Ubuntu does not see the operator
 # home path and has no Simulator, so it runs docs, broker-core, skill
-# ownership, and harness-adoption. Client tests run on GitHub-hosted macOS.
+# ownership, and harness-adoption. Docs and client tests run on
+# GitHub-hosted macOS so archive contracts exercise both GNU tar and bsdtar.
 # Home-path public-surface scanning belongs to `npm test` on the operator
 # machine, not this workflow. Do not raise job budgets to hide hung waits.
 name: Node tests
@@ -54,6 +55,9 @@ jobs:
           node-version: "20"
           package-manager-cache: false
 
+      - name: Public docs contract
+        run: npm run test:docs
+
       - name: client tests
         # Do not add --test-force-exit. On Node 20 it exits the process while
         # later describe() tests are still queued (cancelledByParent).