Fix browser runtime plugin URL packaging

[chubes4]

Summary

• Treat URL-based runtime.plugins as server-packaged browser runtime dependencies by default, while preserving package: \"browser\" for intentional direct browser delivery.
• Add a remote-package URL validator that supports GitHub release ZIPs through the canonical packaging path instead of exposing release/CORS URLs directly to Playground.
• Extend WordPress plugin smoke coverage for Static Site Importer-style release ZIP runtime plugins, local path packaging, component plugin packaging, and the existing Playground runner guard.

Fixes #400.

Testing

• npm install
• npm run build
• npm run wordpress-plugin-smoke (OK, 244 assertions)

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Drafted the WP Codebox browser runtime plugin packaging fix and smoke coverage; Chris remains responsible for review and final validation.