Harden pkgcheck and CI paths

[bbuchsbaum]

No description provided.

[cursor]

Left a non-blocking comment and did not approve because the Cursor Security Agent check skipped rather than completing successfully. Human review is needed; a reviewer was assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}