Verify the built package in CI instead of by hand

[fernandomg]

User story / Problem statement

Currently nothing committed checks what a consumer actually imports. Every gate — lint, typecheck, build, test, knip — runs against src, and a package can pass all of them while shipping something broken.

This is not hypothetical. A throwaway check written by hand in a previous session found two real defects in canton-connect's output that the full green gate had missed: JSDoc stripped from the build, and a peer dependency inlined into the bundle at 143 kB. That check was never committed, so nothing stops either from coming back — in this package or in canton-dappbooster, which also publishes a build.

Expected outcome

CI fails when a published entry point is broken: a missing export, an unresolvable subpath, an inlined dependency that should have stayed external, or comments stripped from the output when they are meant to ship.

Acceptance criteria

• A committed check imports each package's built output — root entry and every declared subpath — and fails if one does not resolve
• The check asserts that peer dependencies are not inlined into the bundle
• It runs in the PR gate, after build
• It covers canton-connect and canton-dappbooster
• Failure output names the entry point and what was wrong

Technical notes

Both packages build with tsdown. The manual version drove createMockAdapter from dist/index.js and confirmed the ./testing subpath resolved; bundle-size assertions caught the inlining. A size budget per entry point may be the cheapest form of the second criterion.