WordPress-plugin zip ships a non-functional bundled CLI (missing @automattic/wp-codebox-core node_modules)

## Summary

The WordPress-plugin zip ships a **non-functional bundled CLI**: `vendor/wp-codebox-cli` contains `dist/*.js` that do runtime `import "@automattic/wp-codebox-core"` / `"@automattic/wp-codebox-playground"`, but those workspace packages are **not present** in the bundled `node_modules`. Running the bundled CLI fails immediately:

```
$ wp-content/plugins/wp-codebox/vendor/wp-codebox-cli/bin/wp-codebox commands --json
node:internal/modules/package_json_reader:301
throw new ERR_MODULE_NOT_FOUND(packageName, fileURLToPath(base), null);
Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@automattic/wp-codebox-core'
imported from .../vendor/wp-codebox-cli/packages/cli/dist/commands/artifacts.js
```

Confirmed on a **freshly deployed v0.8.5 plugin zip** (not just an old build). Because the bundled CLI can't run, production installs are forced to depend on a **separately, manually `npm i -g`'d global CLI** — which then drifts out of sync with the deployed plugin's recipe-writer (we hit `"Unsupported recipe schema"` from exactly this skew on prod).

## Impact

- The WordPress plugin is **not self-contained**. `WP_Codebox_Agent_Sandbox_Runner::default_bin()` prefers the bundled CLI when present, but the bundled CLI is unrunnable, so operators must pin `wp_codebox_bin` to a hand-installed global binary.
- That global binary is unmanaged by deploys → silent version skew → opaque recipe-run failures (the agent-task path returns "did not return valid JSON" downstream when the skewed CLI rejects a newer recipe schema).

## Root cause (where it's packaged)

- `scripts/package-release-artifact.ts` builds the **standalone CLI tarball** correctly: it copies `packages/{runtime-core,runtime-playground,cli}` then runs `npm install --omit=dev ...` in the package root so `@automattic/wp-codebox-cli` (declared `"file:packages/cli"` in the root package.json) and its workspace deps resolve into `node_modules`. That tarball IS self-contained.
- `scripts/build-wordpress-plugin-zip.ts` copies `dist/release/wp-codebox-cli` into the plugin's `vendor/wp-codebox-cli` (`await cp(cliPackageRoot, join(stagingPlugin, "vendor", "wp-codebox-cli"), { recursive: true })`). But the bundled `vendor/wp-codebox-cli` that lands in the deployed plugin **does not contain the resolved `node_modules/@automattic/*`** — so the bare-specifier imports in `dist/*.js` cannot resolve at runtime.

So either (a) the plugin-zip path copies from a CLI root that was never `npm install`ed, or (b) the `node_modules` are excluded during the copy/zip, or (c) the workspace deps need to be vendored differently (the `@automattic/*` packages are **not published to npm**, so they only resolve via the in-monorepo `file:`/workspace linkage at build time — a plain copy won't carry them).

## Fix options

1. **Vendor resolved deps into the plugin zip.** Ensure `build-wordpress-plugin-zip.ts` copies a CLI root that has already had `npm install --omit=dev` run (i.e. reuse the same self-contained `dist/release/wp-codebox-cli` that `package-release-artifact.ts` produces, including its `node_modules`), and confirm the zip step does not exclude `node_modules`.
2. **Bundle to a single file.** Build `packages/cli/dist/index.js` as a standalone bundle (esbuild/rollup) with the `@automattic/wp-codebox-core` / `-playground` workspace packages inlined, so there are no bare `@automattic/*` imports at runtime. This removes the `node_modules` dependency entirely and makes the bundled CLI trivially portable.

Either makes `vendor/wp-codebox-cli` runnable standalone, lets `wp_codebox_bin` point at the bundled CLI, and **eliminates the global-install dependency and the version-skew class permanently.**

## Acceptance criteria

- [ ] In a freshly built plugin zip, `vendor/wp-codebox-cli/bin/wp-codebox commands --json` runs and returns the JSON command catalog (no ERR_MODULE_NOT_FOUND).
- [ ] `recipe-run` works end-to-end via the bundled CLI without any globally-installed `wp-codebox`.
- [ ] A smoke/self-check in `homeboy.json` asserts the bundled CLI boots from the packaged zip (catch this regression automatically).
- [ ] Docs note that `wp_codebox_bin` should default to / point at the bundled CLI, not a global install.

## Repro

1. `homeboy build wp-codebox` (or inspect the deployed plugin).
2. `node /vendor/wp-codebox-cli/packages/cli/dist/index.js commands --json` → ERR_MODULE_NOT_FOUND `@automattic/wp-codebox-core`.
3. Confirm `/vendor/wp-codebox-cli/node_modules/@automattic/` is absent.

## Context

This blocks the Roadie `propose_code_change` → live preview URL flow on the Extra Chill platform (the bundled CLI is the right runtime; the global fallback skews). Filed after shipping v0.8.5 and confirming the bundle is still depless.

Start with scripts/package-release-artifact.ts and scripts/build-wordpress-plugin-zip.ts, comparing how dist/release/wp-codebox-cli and its node_modules are produced and copied. Run the reproduced bundled command and build a fresh plugin zip. Done means the packaged commands catalog and recipe-run work without a global CLI, a homeboy.json smoke check covers startup, and the wp_codebox_bin documentation is updated.

Written by the indexing model from the issue text.