fix: pin SDK version and auto-build dist on install

[lsimpsonsfdc]

Summary

Installing this plugin from a git ref or local path (isLocalPath: true) currently fails or produces a broken install, for two related reasons:

• @paperclipai/plugin-sdk is pinned to latest in package.json/lockfiles. This makes installs non-reproducible — two installs on different days can silently resolve different SDK versions, and a breaking SDK release can brick existing installs with no way to pin back. Pinned to the current release, 2026.722.0.
• There is no prepare script, so dist/ is never built when installing from a git ref or local path (only npm publish triggers prepublishOnly). Consumers installing via { "packageName": "/path/to/paperclip-plugin-agent-usage", "isLocalPath: true }" (documented in this repo's own README) get a plugin with no dist/manifest.js / dist/worker.js, which fails to load in Paperclip.

Both were found while debugging repeated install failures against a self-hosted Paperclip instance.

How to test

rm -rf node_modules dist
npm install        # prepare script now builds dist/ automatically
npm run typecheck
npm run build
npm test

Checklist

• npm run typecheck passes
• npm run build produces dist/manifest.js + dist/worker.js
• Updated the README if a public option or agent tool changed — n/a, no public option or tool changed
• PR is focused (one logical change)

[lacymorrow]

This one needs a rebase: Dependabot #48 just bumped the lockfiles to 2026.722.0 on main, so bun.lock and package-lock.json conflict now. The parts that still matter after that merge are the package.json pin itself (main still says "latest") and the prepare script for git/local installs. Both are worth keeping. If you rebase down to those, happy to re-review.