further isolate black box tests

[pmcelhaney]

I've had a couple of issues where the code passed all of the tests but did not work when installed via npx.

The black box tests should create a "release" and then install / run it using npx.

1. use npm pack to create tarball (.tgz) file
2. use pacote (the same library npm uses under the hood) to extract the .tgz file to a directory, e.g. release-candidate
3. Run the cli using npx ./release-candidate

That way the test suite will truly be black box tests, in a clean environment with no dependencies on source code.