fix(release): stage exact bundled dependencies

[madgegja]

Summary

• rebase publish-lock paths from workspace sources into the standalone package layout
• stage exact direct and nested dependencies beneath bundled workspaces
• bundle the newly merged client/protocol workspaces
• normalize only the incompatible Anthropic SDK peer in staged claude-agent-sdk 0.3.220 while retaining the browser-safe SDK

Verification

• npm run check
• npm run build
• npm run test:scripts (86/86)
• pack tests (11/11), copy tests (5/5)
• isolated tarball install with default npm peer resolution
• npm ls: typebox 1.3.8, Anthropic SDK 0.91.1, Agent SDK 0.3.220, GenAI 2.13.0, Babel parser 8.0.4
• direct production audit: 0 vulnerabilities

[madgegja]

All local gates and the five-agent remediation review pass. The PR Actions run is awaiting first-time fork approval, and this contributor token cannot approve it (HTTP 403). Please approve https://github.com/code-yeongyu/senpi/actions/runs/30711011793 and merge with a merge commit after CI is green.