Separate shipped runtime assets from contributor tooling

> [!IMPORTANT]
> Reserved for @cv. Do not self-assign this issue. Do not open an implementation PR unless @cv requests help.

Parent: #7691

## Problem

`scripts/` contains shipped runtime assets and contributor automation. The npm package includes the complete directory.

## Scope

- Put shipped host and sandbox assets under an explicit runtime path.
- Put checks, development, documentation, release, and E2E tools under `tools/`.
- Keep executable wrappers only when a command entry is required.
- Limit the npm package file list to required runtime assets.

## Acceptance criteria

- Package-contract tests identify every shipped script.
- Contributor-only tools are absent from the package.
- Docker and install paths use the new runtime locations.
- Install, package, and runtime contract tests pass.