release: fix prepack inventory and smoke host mapping

[linfangw]

Summary

• Problem: npm publish prepack could fail on unsafe dist/canvas-host/a2ui/* entries when test-created symlinks leaked into prepared artifacts, and install smoke update lanes could fail to resolve host.docker.internal in Docker.
• Why it matters: release validation and publish-time packaging could fail even when the candidate build itself was otherwise healthy.
• What changed: A2UI asset copying now clears stale output, copies only regular files/directories, and skips symlinked entries; install smoke now always injects a Docker host mapping for non-local update host aliases; regression tests cover both cases.
• What did NOT change (scope boundary): no runtime canvas-host serving behavior or release workflow semantics changed beyond making packaging and install smoke robust.

Verification

• bash -n scripts/test-install-sh-docker.sh
• node scripts/run-vitest.mjs run src/scripts/canvas-a2ui-copy.test.ts test/scripts/test-install-sh-docker.test.ts
• commit hook pnpm check

[gemini-code-assist]

Code Review

This pull request refactors the A2UI asset copying script to improve safety and reliability by implementing a recursive copy that skips symbolic links and ensures a clean destination directory. Additionally, the Docker installation script was updated to inject host mappings for non-local aliases regardless of the host operating system. Review feedback suggests optimizing the copying logic by removing redundant directory creation calls and deferring relative path calculations until they are specifically required for symbolic link warnings.