fix(packaging): workaround yauzl/Node 26 hang + fix API bootstrap contract

Packaging was silently hanging forever because yauzl 2.10.0 read streams
emit no data events under Node 26, causing extract-zip to block indefinitely
inside @electron/packager 20. Fix: postinstall script patches
@electron/packager/dist/unzip.js to use bsdtar (libarchive) instead.
bsdtar was chosen over 7z because 7z refuses chained symlinks in macOS
.app framework bundles. Both package:linux and package:mac now produce
correct output.

Also corrects the V3 API bootstrap contract in api_client.ts:
- SearchQuery body was wrapped in an extra {search_query: ...} layer — removed
- x-no-account-id header standardised to 'bypass'
- Redundant x-no-account-id removed from file download headers
- Smoke test rewritten to validate the real two-step bootstrap path

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -290,3 +290,34 @@ See `documentation/PROJECT__AE_Events_Launcher_Native_integration.md` Section 8
 - **Preload:** Logic defined in `src/preload/index.ts`.
 - **Handlers:** OS-level logic in `src/main/shell_handlers.ts`, `src/main/file_handlers.ts`, and `src/main/system_handlers.ts`.
 - **Types:** Shared TypeScript interfaces in `src/shared/types.ts`.
+
+### Build Requirements (System Dependencies)
+
+`bsdtar` (libarchive) must be present on the build host. It is used by the `postinstall` patch
+to work around a hard hang in `@electron/packager` 20 on Node 26.
+
+| OS | Install |
+| --- | --- |
+| Arch Linux | `sudo pacman -S libarchive` |
+| macOS | `brew install libarchive` (or use the system bsdtar included in Xcode CLT) |
+| Ubuntu/Debian | `sudo apt install libarchive-tools` |
+
+### Why bsdtar — Node 26 Packaging Bug
+
+**Symptom:** `npm run package:mac` or `npm run package:linux` prints
+`Packaging app for platform ... using electron v42.x` then hangs forever (or exits 0 with no output).
+
+**Root cause:** `yauzl` 2.10.0 (used by `extract-zip` inside `@electron/packager` 20) creates
+read streams that never emit `data` events under Node 26. The zip extraction call blocks
+indefinitely.
+
+**Fix:** `scripts/patch-packager-unzip.js` (run automatically via `postinstall`) replaces the
+`extractElectronZip` function in `node_modules/@electron/packager/dist/unzip.js` with a
+`child_process.execSync` call to `bsdtar -xf`. `bsdtar` was chosen over `7z` because `7z`
+refuses to extract macOS `.app` bundles that contain symlinks chained through other symlinks
+(e.g. `Electron Framework.framework/Libraries → Versions/Current/Libraries`, where
+`Versions/Current` is itself a symlink).
+
+**This patch is re-applied automatically on every `npm install`** via the `postinstall` hook.
+If a future release of `@electron/packager` or `extract-zip` fixes Node 26 compatibility,
+remove the `postinstall` line from `package.json` and delete `scripts/patch-packager-unzip.js`.