npm tarball metadata lookup tries `/package.json` before `package/package.json`

Summary

modules/har/pkg/har/push_npm.go:162–168 looks for package.json inside an npm tarball using /package.json first, then falls back to package.json. Standard npm tarball layout is package/package.json, so the common case fails the first attempt and only succeeds on fallback — adds latency, and intermediate error messages confuse users / agents reading stderr.

Suggested fix

Swap the order, or normalize entry names by stripping leading slashes inside readFileFromTarGz:

// try the standard layout first
data, err := readFileFromTarGz(tarPath, "package/package.json")
if err != nil {
    // fall back to the legacy layout
    data, err = readFileFromTarGz(tarPath, "/package.json")
    if err != nil {
        return ..., fmt.Errorf("could not find package.json in %s: %w", tarPath, err)
    }
}

Or unify by normalizing inside the reader:

// inside readFileFromTarGz: trim leading slash on header.Name
trimmed := strings.TrimPrefix(header.Name, "/")
if trimmed == name { ... }

Acceptance

• Order corrected, or reader normalizes paths.
• Test against a real npm tarball — first attempt succeeds, no fallback log noise.
• Test against a non-standard tarball — fallback path still works.

Start in modules/har/pkg/har/push_npm.go:162–168 and inspect readFileFromTarGz. Verify the standard package/package.json lookup against a real npm tarball, then confirm that a non-standard tarball still uses the fallback and that no unnecessary fallback error is emitted.