fix(postinstall): leave the global bin entry alone on local installs

Fixes #2214

Problem

fixUnixSymlink treated any existing $(npm prefix -g)/bin/agent-browser symlink as proof of a global install. On a machine with a global agent-browser, a local npm i or npm ci of a project that depends on it repointed the global command into that project's node_modules/agent-browser/bin/. Once the project was deleted (a worktree, CI checkout or temporary clone), agent-browser was a dangling symlink.

Fix

A new helper, isInThisPackage(path), checks whether a path resolves (via realpath) into the package running postinstall.

• Unix: the symlink is replaced only if it already resolves into this package. On a global install it points at this package's wrapper, or at its native binary after an earlier upgrade. On a local install it points into the separate global copy, so it's left alone.
• Windows: the shims are rewritten only when this package is $(npm prefix -g)/node_modules/agent-browser itself.

This doesn't depend on npm_config_global, so it doesn't rely on how each package manager reports a global install.

Testing

• New test/postinstall.test.mjs (pnpm run test:postinstall, added to the Launcher CI job). It runs the real scripts/postinstall.js inside temp packages, with a fake global prefix via npm_config_prefix and a native binary already in place, so nothing is downloaded:
  • global install: the global link ends up pointing at the native binary (unchanged behavior)
  • local install: the global link still points at the global copy. This test fails on main.
• pnpm run test:launcher still passes (4/4).
• The tests skip on Windows and musl, where the binary name or shims differ. I didn't test the Windows shim guard on Windows.

🤖 Generated with Claude Code