Fix Claude plugin skills path and pack integrity guard

[Baijack-star]

Summary

• point .claude-plugin/plugin.json at the shipped top-level ./skills/ directory
• extend the build-chain drift asserter to fail if the Claude manifest points skills anywhere else
• extend the same asserter to fail when start.mjs, server.bundle.mjs, or cli.bundle.mjs is missing from the plugin root
• add regression coverage that the package manifest / npm pack --dry-run include the Claude manifest, start.mjs, runtime bundles, and top-level skills

Why

This closes the first failure mode in #658: the published package contains skills/..., but the Claude plugin manifest pointed at ./.claude/skills/, which is not shipped.

It also covers the later install-corruption report where the manifest loads but start.mjs / server.bundle.mjs are absent, leaving the host looking connected while exposing zero MCP tools. The build-chain asserter now catches that shape directly when run against a package or plugin-root checkout.

Verification

• node scripts/assert-asymmetric-drift.mjs
• npm_config_cache=/tmp/npm-cache-context-mode npm pack --dry-run --json | node -e ...
• npm_config_cache=/tmp/npm-cache-context-mode npx vitest run tests/scripts/asymmetric-drift-assert.test.ts

Note: corepack pnpm exec vitest ... could not run before local dependency install because this checkout has no pnpm-lock.yaml and no installed vitest; I used npm with an isolated cache for the targeted test.

Closes #658