fix: make release tarball install wp-codebox binary

[chubes4]

Summary

• Adds a root wp-codebox bin mapping so the GitHub Release workspace tarball can be installed as a stable binary path instead of requiring a local feature worktree.
• Adds npm run package-installed-binary-smoke, which packs the root release tarball, installs it into a temporary global prefix, and verifies the installed wp-codebox binary can emit the command catalog.
• Updates release/install docs and Codex cookbook notes to distinguish the current blocker: v0.4.0 includes the fresh sandbox session fix and Codex recipe, but its release asset predates this bin mapping and needs a new approved release tarball.

Closes #506.

Verification

• npm run package-distribution-smoke
• npm run package-installed-binary-smoke
• node -e 'JSON.parse(require("fs").readFileSync("examples/recipes/cookbook/codex-agent-smoke.json", "utf8")); console.log("codex-agent-smoke.json valid")'

Release note

No npm publish, tag, GitHub Release, or registry mutation was performed. After merge, the release-manager path is:

npm run check
npm run package-installed-binary-smoke
npm pack --json
npm pack --workspace @automattic/wp-codebox-cli --dry-run --json
npm run package:wordpress-plugin
unzip -Z1 packages/wordpress-plugin/dist/wp-codebox.zip

If npm publishing is approved, publish all scoped packages from the same clean release commit:

npm publish --workspace @automattic/wp-codebox-core --access public
npm publish --workspace @automattic/wp-codebox-playground --access public
npm publish --workspace @automattic/wp-codebox-cli --access public

The expected GitHub Release tarball asset from the current package version is wp-codebox-workspace-0.5.0.tgz.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (gpt-5.5)
• Used for: Investigated issue Release CLI with fresh sandbox session and Codex recipe support #506 and current release/package/install docs, implemented the root binary mapping and installed-binary smoke, updated release/Codex docs, ran targeted verification, and drafted this PR description; Chris remains responsible for review and release approval.