Modernize helper package distribution contracts

[ty-everett]

Summary

• modernize the build, type, lint, test, and exact-tarball contracts for create-bsv-app, @bsv/did, @bsv/did-client, @bsv/simple, and @bsv/templates
• produce deliberate CJS/ESM package outputs and correct export/type maps, with browser/server separation where applicable
• add a reusable exact-tarball browser consumer checker covering Vite, esbuild, and existing UMD contracts
• remove local dependency overrides from @bsv/did-client and @bsv/simple
• make the installed create-bsv-app CLI contract testable, including --help
• preserve the canonical Open BSV License v6 in every affected published artifact
• resolve the PR's Sonar Unicode and duplication findings in source, including a shared tested subprocess runner

Part of #324.

Progressive quality boundary

This change reduces the repository health baseline from 83 findings to 70 findings (0 errors). It fully standardizes and formats create-bsv-app, whose test suite was expanded to cover interactive prompting/cancellation, install-manager selection, CLI validation, configuration error paths, and documentation edge cases. The four lower-coverage legacy packages are not mechanically reformatted in this PR: their remaining formatting findings are intentionally retained until tests are expanded, so a formatting-only rewrite cannot conceal untested new-code paths from Codecov or Sonar. Their distribution, type, lint, test, pack, browser, and license contracts are nevertheless upgraded here.

Validation

• create-bsv-app: format, build, typecheck, lint, 261 tests, coverage, exact pack, and installed CLI checks passed; 97.65% line and 86.41% branch coverage
• @bsv/did: build, typecheck, lint, 8 tests, coverage, and exact pack checks passed
• @bsv/did-client: build, typecheck, lint, 6 tests, coverage, exact pack, and Vite/esbuild/UMD browser checks passed
• @bsv/simple: build, typecheck, lint, 102 tests, coverage, exact pack, and Vite/esbuild browser checks passed
• @bsv/templates: build, typecheck, lint, 60 tests, coverage, and exact pack checks passed
• pnpm health:check passed with 70 findings and 0 errors
• pnpm audit:security passed with no known vulnerabilities
• pnpm license:pack-check passed for all 30 public tarballs
• wallet-toolbox browser and mobile consumer contracts passed after subprocess-runner consolidation
• Codecov patch coverage passed at 90.146%
• SonarCloud passed with 0 new issues, 0 accepted issues, 0 security hotspots, and 2.6% new-code duplication
• CodeQL, dependency review, Socket, docs, conformance, generated types, all test/coverage shards, and the merge gate passed on exact head d35bca097
• no unresolved review threads

Measured browser artifacts remain within explicit raw/gzip/Brotli budgets:

• DID Client Vite: 442,615 / 114,273 / 93,864 bytes
• DID Client esbuild: 342,589 / 105,048 / 88,682 bytes
• DID Client UMD: 339,622 / 101,117 / 85,508 bytes
• Simple Vite: 685,556 / 167,242 / 136,588 bytes
• Simple esbuild: 531,465 / 155,101 / 130,045 bytes

[codecov]

Codecov Report

❌ Patch coverage is 90.14599% with 27 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...helpers/create-bsv-app/src/scaffold/new-project.ts	71.42%	0 Missing and 6 partials ⚠️
packages/helpers/create-bsv-app/src/cli.ts	85.71%	1 Missing and 3 partials ⚠️
...ckages/helpers/create-bsv-app/src/config/detect.ts	75.00%	0 Missing and 2 partials ⚠️
...pers/create-bsv-app/src/config/project-manifest.ts	84.61%	0 Missing and 2 partials ⚠️
packages/helpers/create-bsv-app/src/prompts.ts	92.30%	0 Missing and 2 partials ⚠️
...rs/create-bsv-app/src/scaffold/express-skeleton.ts	0.00%	1 Missing and 1 partial ⚠️
packages/helpers/ts-templates/src/StasToken.ts	0.00%	0 Missing and 2 partials ⚠️
...ackages/helpers/create-bsv-app/src/config/draft.ts	87.50%	0 Missing and 1 partial ⚠️
packages/helpers/create-bsv-app/src/engine.ts	93.33%	1 Missing ⚠️
packages/helpers/create-bsv-app/src/pipeline.ts	88.88%	0 Missing and 1 partial ⚠️
... and 4 more

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
2.6% Duplication on New Code

See analysis details on SonarQube Cloud

[ty-everett]

Maintainer review on exact head d35bca09736ce31c9cf4b35ed9e6226321301c44: approved in substance. I reviewed the package export/type maps, exact-tarball consumer checks, browser/platform budgets, override removals, Open BSV License v6 artifact enforcement, Sonar remediation, and added branch coverage. All required and advisory checks are green; Codecov patch coverage is 90.146%; Sonar reports 0 new/accepted issues and 0 security hotspots; CodeQL, Dependabot, and secret scanning report 0 open alerts; and there are no unresolved review threads. GitHub does not permit an author to submit an APPROVE review on their own PR, so this COMMENT records the requested ty-everett maintainer approval before admin merge.