fix: isolate OpenCode plugin factory export

[dataforxyz]

Summary

• keep the OpenCode-configured dist/plugin.mjs default-export-only so OpenCode v1 does not attempt to invoke library values as plugin factories
• move the package library surface to dist/index.mjs, preserving the existing public notice-ingress exports at the package root
• add bundle-contract coverage and update packaging/build assertions for the new library bundle
• repair the npm lockfile’s missing optional platform packages while retaining the credential-free HTTPS Core dependency URL

Validation

• npm ci
• npm run build
• npm run typecheck
• npm test — 143 passed
• local review preview — APPROVED