fix: key stage download --json output by package name (v11)

[reggi]

Backports #9380 to release/v11 to keep npm stage download --json output consistent across branches.

On release/v11, the key == null guard in lib/utils/tar.js was emitting the bare object (no wrapper key). This change adds a key so the output matches latest and aligns with npm publish --json / npm pack --json.

Before (on release/v11)

{
  "name": "polo-meow-meow-meow",
  "version": "1.0.3",
  ...
}

After

{
  "polo-meow-meow-meow": {
    "name": "polo-meow-meow-meow",
    "version": "1.0.3",
    ...
  }
}

Background

The key == null fallback in lib/utils/tar.js (still present on release/v11) was removed from latest in #9247 ("fix: sync json output of pack and publish") as a BREAKING CHANGE. Per that PR:

BREAKING CHANGE: the --json output of npm pack and npm publish have changed. They are now always consistent, and in the same format.

Previously, npm pack would output an array of entries and npm publish an object. The npm publish object also changed forms depending on if workspaces were being published.

Now, the output is always an object with the package name as the top level index.

That breaking change was intentionally not backported to v11 (maintenance branch), so the fallback still exists here. This backport keeps the call-site contract aligned across branches so consumers get the same { "<pkg>": {...} } shape on both.

Clean cherry-pick of 9f7834d from #9380.