fix(ci): resolve unpublished core tarball in Yarn smoke fixture

[canblmz1]

Summary

• Add a fixture-local Yarn resolution so the packed CLI resolves its unpublished core dependency from the supplied tarball.
• Retain the actual Yarn install and CLI smoke execution.
• Add two regression tests covering command ordering and fixture-only writes.

Production package manifests, versions, dependencies, publishing commands, permissions, and token scope are unchanged.

Validation

• Independent review completed; 44 focused tests pass, with both new regressions failing against the previous workflow.
• Exact-commit CI is required. Passing this maintenance PR alone does not validate the original unpublished-version scenario: the refreshed 2.0.6 version PR must also pass the real Yarn smoke before publication.

AI-assisted maintenance prepared for Can; reviewed independently. Related: #32.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.