fix: block destructive npx installer paths

[jsleemaster]

What

• adds full-tree runtime regression tests for marked and markerless installs, consumer-modified installed files, consumer-added files, destructive commands, dry-run variants, and a fresh install
• removes automatic recursive deletion of an existing .gooblin/ from the source installer
• makes destructive source operations fail with a recovery-oriented explanation
• explicitly warns that published npm 1.3.1 predates the guard
• validates Node 18, 20, and 24

Why

The current marker does not record file ownership or hashes, so recursively deleting .gooblin/ can remove user-added or modified files. This source patch blocks destructive paths until #49 introduces owned-file tracking.

TDD evidence

The test-only commit cc48f48 failed in Validate run 29229998885:

Error: install --force must fail until owned-file tracking exists

Remaining before #57 can close

The live npm 1.3.1 package still contains the old destructive behavior. This PR intentionally does not close #57. After merge, a new immutable package version must be published and verified, then the warnings can be updated with that evidence.

Part of #57.