fix(packaging): workaround yauzl/Node 26 hang + fix API bootstrap contract

Packaging was silently hanging forever because yauzl 2.10.0 read streams
emit no data events under Node 26, causing extract-zip to block indefinitely
inside @electron/packager 20. Fix: postinstall script patches
@electron/packager/dist/unzip.js to use bsdtar (libarchive) instead.
bsdtar was chosen over 7z because 7z refuses chained symlinks in macOS
.app framework bundles. Both package:linux and package:mac now produce
correct output.

Also corrects the V3 API bootstrap contract in api_client.ts:
- SearchQuery body was wrapped in an extra {search_query: ...} layer — removed
- x-no-account-id header standardised to 'bypass'
- Redundant x-no-account-id removed from file download headers
- Smoke test rewritten to validate the real two-step bootstrap path

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/patch-packager-unzip.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+// extract-zip/yauzl streams hang on Node 26 (no data events emitted).
+// bsdtar (libarchive) handles both Linux and macOS zips including chained symlinks in .app bundles.
+const { writeFileSync, existsSync } = require('fs');
+const { resolve } = require('path');
+
+const target = resolve('node_modules/@electron/packager/dist/unzip.js');
+if (!existsSync(target)) {
+  console.log('patch-packager-unzip: target not found, skipping');
+  process.exit(0);
+}
+
+const patched = `import { execSync } from 'node:child_process';
+// extract-zip/yauzl streams are broken on Node 26; use bsdtar (libarchive) instead.
+// bsdtar correctly handles chained symlinks in macOS .app bundles that 7z refuses.
+export async function extractElectronZip(zipPath, targetDir) {
+    execSync(\`bsdtar -xf "\${zipPath}" -C "\${targetDir}"\`, { stdio: 'pipe' });
+}
+//# sourceMappingURL=unzip.js.map
+`;
+
+writeFileSync(target, patched);
+console.log('patch-packager-unzip: patched @electron/packager/dist/unzip.js to use bsdtar');