build: make Agent Trace 0.1.2 installable

[NWYLZW]

Summary

• rename the existing package-v4 descriptor to the Host-standard cordisx-package.json
• add a deterministic browser ESM bundle at dist/runtime/module.js, with only public CordisX runtime modules external
• bump package and descriptor metadata to 0.1.2 and restore accurate conditional Marketplace installation guidance
• add package-contract coverage and require the standard manifest/browser entry in release checks

This is a packaging-only change. All plugin source files and runtime-manifest.json retain their prior SHA-256 values; capabilities and permission scopes are unchanged.

Verification

• npm run check (7 test files, 29 tests passed; build, naming, and package dry-run included)
• npm run format:check
• npm run lint:source
• git diff --check
• real archive inspection: cordisx-package.json, runtime-manifest.json, dist/runtime/module.js, and both READMEs present
• Host JsonPackageManifestV2Resolver accepted package-v4/manifest-v5
• Host stageResolvedPluginPackage built and staged the archive successfully with shared imports limited to cordisx/contracts, cordisx/react, cordisx/react/jsx-runtime, and cordisx/ui
• staged package loaded back as agent-trace-showcase@0.1.2

The existing v0.1.1 documentation/source archive remains unchanged.