npx-migration: flip plugin launcher to npx; delete bun launcher + workspace-freeze staging (comms-iw8w.5)

[GraemeF]

Flips the Claude Code plugin's MCP launcher from the launch.sh bun bootstrap to npx -y @codeforbreakfast/commy-mcp with cwd: ${CLAUDE_PLUGIN_ROOT}, dropping the consumer prerequisite from bun to node.

What changes

• .mcp.json: command: npx, args: [-y, @codeforbreakfast/commy-mcp] (bare name — no version pin on the command line, so a local install can shadow the registry), cwd: ${CLAUDE_PLUGIN_ROOT}. Env block unchanged.
• Delete launch.sh + launch.test.ts; add launcher.test.ts pinning the npx command shape, the bare-name/cwd contract, and the realm-credential env keys.
• Rewrite publish-marketplace.ts: stage the self-contained node bundle as a local node_modules/@codeforbreakfast/commy-mcp override under the plugin dir, instead of freezing the whole bun workspace and running bun install. verifyBoots now runs the staged bundle under node for the MCP initialize smoke test. No source tree, no workspace, no install step.
• dependencies.test.ts: comment reframed for the bundle model (the test still guards that every runtime import is a declared dependency so the bundle build can resolve it).
• Docs (README.md, clients/claude-code/README.md, docs/self-hosting.md): node-only consumer contract — npx pulls the published bundle; bun/nix are development-only.

How resolution works

npx resolves a package from its cwd's node_modules before the registry. With cwd: ${CLAUDE_PLUGIN_ROOT}:

• an external consumer (no local install) resolves the published @codeforbreakfast/commy-mcp from npm;
• a host that stages the bundle locally (publish-marketplace) runs its own copy with zero registry hits.

Both paths, the -y behaviour, and the cwd field support were verified empirically against the published package.

bun run check green (833 pass).