fix(install): bundle skillgrade via bundledDependencies (#172)

[luongnv89]

Closes #172

Summary

Reinstalling agent-skill-manager via npm install -g was leaving the bundled skillgrade dependency unreachable whenever the registry or local npm cache was unhealthy, which breaks the transparent-install contract promised by #165 — asm eval --runtime init keeps failing with "skillgrade not installed" after a reinstall.

Switches skillgrade from a plain dependencies entry to a bundledDependencies entry so it ships inside the packed tarball. Reinstalls (and offline / air-gapped / registry-flaky installs) now always land a working skillgrade copy.

Approach

• Add bundledDependencies: ["skillgrade"] to package.json. npm now packs the resolved node_modules/skillgrade/ tree into the tarball.
• Add three e2e regression tests in tests/e2e/npm-install-e2e.test.ts that guard the fix at different layers — post-install reachability, tarball contents (the discriminating test), and the asm eval --runtime init end-to-end flow.

Tarball size trade-off: packed size grows from 962kB -> 5.3MB (45 -> 2129 files). Intentional — skillgrade drives the asm eval --runtime contract, so it must ship with asm by default. ASM_SKILLGRADE_BIN still lets power users point at a system skillgrade.

Changes

File	Change
package.json	Add bundledDependencies: ["skillgrade"] so npm pack embeds the skillgrade tree.
tests/e2e/npm-install-e2e.test.ts	Add three regression tests for issue #172; bump default timeout to 120s for the runtime-eval test.

Test Results

• bun test tests/e2e/npm-install-e2e.test.ts -> 18 pass, 0 fail (15 existing + 3 new).
• bun test src/ -> 1576 pass, 0 fail.
• Unit tests for the skillgrade provider (src/eval/providers/skillgrade/) -> 87 pass, 0 fail.
• Manually verified the discriminating tarball embeds skillgrade via bundledDependencies test fails without the bundledDependencies change and passes with it, confirming it actually guards the fix.
• Manually verified a fresh npm install --global --prefix <tmp> --offline <tarball> succeeds and asm eval <skill> --runtime init scaffolds eval.yaml without a separate skillgrade install.

Acceptance Criteria

• After a fresh npm install -g agent-skill-manager, asm eval <skill> --runtime init works without a separate skillgrade install step (high) — confirmed offline.
• Reinstalling over an existing broken install restores skillgrade to a working state (high) — bundledDependencies guarantees the nested copy is always restored from the tarball.
• If installation/bundling of skillgrade fails, the install surfaces a clear, non-fatal warning telling the user how to install skillgrade manually (high) — out of scope for this PR; tracked separately via Improve "skillgrade not installed" error with manual install fallback #173 which improves the runtime error message with the manual-install fallback.
• A smoke test (CI or release check) verifies a clean global install produces a working asm eval --runtime flow (medium) — new e2e test eval --runtime init scaffolds eval.yaml via bundled skillgrade in tests/e2e/npm-install-e2e.test.ts.