fix(plugin-sdk): make require('trek-plugin-sdk') actually resolve everywhere

A freshly scaffolded plugin could not load anywhere: the npm package is
ESM-only (no require condition in its exports map), so the scaffold's
require('trek-plugin-sdk') threw ERR_PACKAGE_PATH_NOT_EXPORTED under
`trek-plugin dev` - and the runtime injection the wiki promised for the
plugin child never existed, so a packed plugin (node_modules stripped)
crashed with MODULE_NOT_FOUND after a real install.

- plugin child: inject a frozen {definePlugin, PLUGIN_API_VERSION} shim
  for require('trek-plugin-sdk'); subpaths fail with a pointed error
- trek-plugin dev: inject the exact same shim, so a fresh scaffold runs
  with zero npm install and dev parity with production holds
- npm package: ship a real CommonJS build (dist/cjs + require export
  conditions) so the installed package also requires cleanly on Node 18+
- create: scaffold a package.json (type commonjs, SDK as devDependency,
  npx scripts); print resolvable `npx trek-plugin-sdk ...` hints
- wiki: package.json in the scaffold tree + publishing checklist, and
  document the zero-install dev flow

server/tests/integration/plugins/supervisor.test.ts

@@ -92,6 +92,33 @@ describe('PluginSupervisor — isolated runtime', () => {
     expect(events.some((e) => e.topic === '__log')).toBe(true);
   });
 
+  it('injects require(trek-plugin-sdk) — a scaffold-style plugin loads with no node_modules', async () => {
+    const events: Array<{ topic: string; data: unknown }> = [];
+    sup = makeSupervisor(events);
+
+    writePlugin(
+      'scaffolded',
+      `const { definePlugin, PLUGIN_API_VERSION } = require('trek-plugin-sdk');
+      let testingError = '';
+      try { require('trek-plugin-sdk/testing'); } catch (e) { testingError = e.message; }
+      module.exports = definePlugin({
+        async onLoad() {
+          process.send({ k: 'evt', topic: 'diag', data: { api: PLUGIN_API_VERSION, fn: typeof definePlugin, testingError } });
+        },
+        routes: [{ method: 'GET', path: '/hello', auth: true, async handler() { return { status: 200 }; } }],
+      });`,
+    );
+
+    await sup.activate('scaffolded', new Set(['db:own']), {});
+    expect(sup.isActive('scaffolded')).toBe(true);
+
+    const diag = events.find((e) => e.topic === 'diag')?.data as { api: number; fn: string; testingError: string };
+    expect(diag).toBeTruthy();
+    expect(diag.api).toBe(1); // the injected shim, not a vendored copy
+    expect(diag.fn).toBe('function');
+    expect(diag.testingError).toMatch(/build\/test-time/); // subpaths fail with a pointed message
+  });
+
   it('a plugin that throws in onLoad fails activation and is marked error — the host survives', async () => {
     const events: Array<{ topic: string; data: unknown }> = [];
     sup = makeSupervisor(events);