chore(ci): wire the app-bundle dist build into CI + the release pipeline (the #822 packaging stub's follow-up)

[aarontrowbridge]

Important

Problem — #822 landed the app-shelf packaging hooks (the build:app recipe: materialize → bun install → vite build → stage into the extension's packaged dist path) and the env-gated live boot proof, but the FULL bun build is NOT wired into CI or the release pipeline — the ci.yml boot-proof lane self-skips (no dist on the runner) and a vsce package run without a preceding build:app ships a VSIX whose shelf honestly serves the needs-setup placeholder instead of the app. Until the dist build rides CI + release, the shelf works only on dev machines that ran build:app by hand.

Approach — Add a CI lane that runs the build:app recipe on the runner (bun setup + the app-bundle materializer's cached tarball fetch), feed the staged dist to the existing boot-proof lane (flip its skip into the real run), and run build:app inside the release packaging recipe so every VSIX carries the dist. Gate the VSIX contents: once the dist rides, a packaging-manifest assertion should require the app document in the packaged extension (the never-silent-skip rule).

Acceptance Criteria

• CI runs the build:app recipe end-to-end on the runner (materialize fetch + bun install + vite build all green), and the boot-proof lane runs the probe FOR REAL (no SKIP) against that dist
• The release packaging recipe stages the app dist before vsce package, and a packaging gate asserts the app document is present in the packaged extension
• The probe's skip branch still covers local/dev use honestly (absent dist → printed SKIP, exit 0)