feat: launch the Coana CLI from GCS instead of npm

[Oskar Haarklou Veileborg (BarrensZeppelin)]

Coana releases are moving from npm to a private GCS bucket, which the
Socket API hands out signed download URLs for. Socket CLI now runs Coana
the way coana-package-manager's "Launching Coana" docs specify:

• It looks the version up in the cache that Coana and the Socket CLIs
  share, through coana-cache.mjs, which is vendored from
  coana-package-manager and generated there.
• On a miss it asks POST /orgs//coana-cli/artifacts for the cli
  component, downloads the signed URL while checking its size and
  sha256, extracts it with tar and installs it into the cache. An
  expired URL is renewed once.
• It runs cli-wrapper.mjs with the Node running Socket CLI.

A version spec that only matches releases from before the move fails
with the API's explanation that those need an older Socket CLI. There is
no npm fallback, so the npx, pnpm dlx, yarn dlx and npm install launch
paths are gone, along with SOCKET_CLI_COANA_LAUNCHER.
SOCKET_CLI_COANA_LOCAL_PATH still works.

The launcher moves from dlx.mts to coana-release.mts as spawnCoana. Its
npm_package_* stripping now works: the registry's spawn merged
process.env back in, so the variables need to be set to undefined.

Part of REA-875.

src/vendor/coana-cache.mjs is generated in coana-package-manager and isn't meant to be reviewed here. The download path depends on the artifacts endpoint from REA-871.

Expected reviewer effort: Full code review

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

---

Note

High Risk
Changes how fix and reachability invoke Coana (org/API-gated downloads, no npm fallback), which is a core dependency path for enterprise workflows.

Overview
Socket CLI no longer runs @coana-tech/cli through npx/pnpm/yarn dlx or the npm-install fallback. Fix and reachability scan now call spawnCoana in coana-release.mts, which resolves the pinned version in the shared Coana cache ($XDG_CACHE_HOME/socket/coana), downloads the CLI from Socket via POST /orgs/<org>/coana-cli/artifacts when missing (checksum-verified tarball extract with tar), and runs cli-wrapper.mjs. The vendored coana-cache.mjs is copied into dist at build time.

SOCKET_CLI_COANA_LAUNCHER and all dlx/npm Coana launcher logic are removed from dlx.mts; SOCKET_CLI_COANA_LOCAL_PATH is unchanged. Docs, changelog, bump-coana skill, and lint ignores are updated for the new distribution model.

^{Reviewed by Cursor Bugbot for commit 034dbef. Configure here.}