Restore the source package manifests; check the built ones in CI

The six wasm packages carried the build's rewritten package.json as their
source: exports, browser and react-native pointing at ./build/cjs/*, main at
./build/cjs/index.js. The build rewrote them again, so the published 7.5.17
and 7.5.19 had exports naming files that are not in the package (init's
"." resolved to ./build/cjs/wasm.js) and './package.json' spread into an
object of characters. This is the January 2026 ./cjs/cjs/ fault in another
form; its cause was committing built manifests, not the build script.

main, module, types, exports, browser, react-native and sideEffects are back
to the form of the upstream sources they were renamed from; the build
generates the rest. scure-sr25519 has no upstream counterpart and a
consistent hand-written manifest, so it is left as it is.

CI now checks every build/package.json: each entry point must name a file
that is there, with no ./build/ or ./cjs/cjs/ path, no numeric keys in
exports and no workspace/portal ranges. Red on the 7.5.19 build, green on
this one.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -24,6 +24,13 @@ jobs:
       - name: Build JavaScript
         run: yarn build:js
 
+      # The package.json each build/ directory holds is what npm receives:
+      # every entry point must name a file that is there, with no ./build/ or
+      # ./cjs/cjs/ paths and no string spread into exports (what broke the
+      # January 2026 releases and 7.5.19).
+      - name: Check built manifests
+        run: python3 scripts/check-built-manifests.py . wasm-util wasm-bridge wasm-crypto-asmjs wasm-crypto-wasm wasm-crypto-init wasm-crypto
+
       - name: Lint
         run: yarn lint