[codex] harden package surface smoke

[heznpc]

What changed

• Added a package-surface smoke test that runs npm pack --dry-run --json after build and asserts the tarball includes the built CLI/MCP bin, plugin metadata, MCP wiring, registry metadata, and skill file.
• Updated npm run build to mark dist/index.js executable so the packaged bin target ships with mode 0755.
• Aligned README CLI usage blocks with the actual audit, seed, and add-component subcommands; updated Korean README implementation details for the 7 MCP tools and 8 core + optional security check model.

Why

The package claims to ship one CLI/MCP/plugin/skill surface, but a local dry-run pack before this change did not guarantee a built executable bin in the tarball. The new smoke test turns that release surface into a PR-time check.

Validation

• npm ci --ignore-scripts
• npm run build && node --test --import tsx tests/package-surface.test.ts
• npm test
• npm run lint
• npm run build
• npm audit --audit-level=high
• npm pack --dry-run --json