fix(npm): match what the real npm client sends for scoped packages

Context

Scoped packages are broken against the real npm CLI on two wire contracts, found by the e2e harness (!867 (merged)) and amended in the spec by !868 (merged):

• Publish: streampub expected the scope-stripped _attachments key, while libnpmpublish keys the attachment by manifest.name verbatim, so every scoped publish failed with 400 publish_envelope_invalid.
• Install: the packument's dist.tarball URL carried the scoped name with a raw slash, which the single-segment {package_name} download route can never match, so every scoped install 404'd on the tarball GET.

Changes

• streampub's expected attachment key is now the full {name}-{version}.tgz.
• The packument generator percent-encodes the name in dist.tarball (@scope%2Fpkg), the form the packument GET route already resolves.
• The stored npm_files.file_name keeps the scope-stripped form, derived independently in publish_commit.go (untouched).
• Test-first on both counts: the streampub happy path publishes @scope/pkg with the full-name key and a new shape case rejects the stripped key; the tarball-URL table pins the encoded scoped form (all failed pre-fix). The precheck integration table gains the discriminating HTTP-boundary case, the scoped publish-commit test asserts the key to stored-file-name mapping, and the Step 22 observability fixture publishes with the full-name key.

Deploy note: packument cache rows written pre-fix keep the raw-slash dist.tarball until TTL or the next write rebuilds them, so scoped installs heal with the cache.

Stacked on !868 (merged); the e2e harness MR (!867 (merged)) adds real-CLI scoped coverage on top of this one.

Related to #143 (closed)