[lmtlssss]

Add an independent verifier for npm package ↔ reviewed Git tag equivalence

The README currently warns that we do not provide tooling to verify whether the npm release matches GitHub. This PR provides such a tool without changing runtime code or how packages are published.

tools/verify-npm-release.mjs runs on a clean checkout of an independently reviewed exact release tag. It runs npm pack --ignore-scripts for the local source and for the pinned registry version, then compares every packaged regular file by relative path and SHA-256. It fails on altered, missing, unexpected, duplicate, non-regular, or unsafe-path archive entries. The comparison streams members from tar without extracting untrusted archives or executing package lifecycle scripts. A separate --compare mode checks two offline tarballs.

The README warning becomes a pointer to docs/verify-npm-release.md, which explains how to use a separately audited copy of the verifier against older release tags that don't contain it and documents the trust limitations.

Evidence

• Actual upstream published release: Independently checked out bitcoinjs/bitcoinjs-lib tag v7.0.1, exact commit dc7f0673a8789afed0850ef4c49659d092c5b963, and compared its npm pack --ignore-scripts output against the actual npm registry bitcoinjs-lib@7.0.1 package. 93 source files = 93 published files, with zero missing, extra, or modified files.
• Offline regressions: 5/5 Node built-in tests passed: identical files, content replacement, missing/extra files, refusal of symlinks, refusal of archive traversal.
• Both ran on GitHub-hosted Ubuntu with no publication credentials: https://github.com/lmtlssss/bitcoinjs-lib/actions/runs/40235562971

Boundaries

This does not indicate the npm registry release was compromised (v7.0.1 matched). It does not authenticate Git tag ownership/signatures, protect dependencies, or prove future publication provenance. It is an independent consumer-controlled equivalence check, complementary to reviewed release tags and attestation/Trusted Publishing. No package behavior, release process, wallet funds, or private keys were changed.

The verifier uses standard Node APIs plus git, npm, and tar, with no new npm dependencies.