perf: lighter, louder local install — vendored ReDoc, bootstrap failures shown in the session

- Plugin bootstrap: a failed npm install, a Node older than 22.5 or a failed UI
  build is recorded in runtime/last-failure.json; the next SessionStart prints
  it once as a systemMessage naming the log and /agenthub-doctor (a different
  failure is reported again; a successful bootstrap clears it). The foreground
  pass checks the Node version itself and spawns no worker on an old Node.
- ReDoc: the standalone bundle (redoc 2.5.4, MIT, licence files kept) is
  vendored under server/vendor/redoc/ and the `redoc` dependency dropped —
  a runtime install (npm ci --omit=dev --ignore-scripts) goes 126 MB -> 45 MB.
  vendor/ is excluded from the header audit and prettier.
- git missing from PATH: lane git actions answer 503 EGITMISSING with the
  install command instead of a bare ENOENT.
- package.json engines: node >=22.5.0 (node:sqlite), matching MIN_NODE.
- Docs: INSTALL.md is the one install/setup guide (SETUP.md merged in and now a
  pointer); no VS Code extension claim, one client-install hint, no
  windows-build-tools, better-sqlite3 notes scoped to checkouts, new
  "Plugin bootstrap never comes up" troubleshooting entry.

server/__tests__/plugin-bootstrap.test.js

@@ -91,6 +91,41 @@ describe("node version gate", () => {
   });
 });
 
+describe("last failure report (SessionStart systemMessage)", () => {
+  beforeEach(resetRuntime);
+
+  it("reports a recorded failure once, naming the log and /agenthub-doctor", () => {
+    boot.recordFailure(RT, "install-failed", "npm broke", path.join(RT, "npm-install.log"));
+    const first = boot.takeFailureReport(RT);
+    assert.match(first.systemMessage, /npm broke/);
+    assert.match(first.systemMessage, /npm-install\.log/);
+    assert.match(first.systemMessage, /\/agenthub-doctor/);
+    assert.equal(boot.takeFailureReport(RT), null);
+  });
+
+  it("does not re-report the same failure recorded again by a later retry", () => {
+    boot.recordFailure(RT, "install-failed", "npm broke", "x.log");
+    boot.takeFailureReport(RT);
+    boot.recordFailure(RT, "install-failed", "npm broke", "x.log");
+    assert.equal(boot.takeFailureReport(RT), null);
+  });
+
+  it("reports a different failure, and nothing once cleared", () => {
+    boot.recordFailure(RT, "install-failed", "npm broke", "x.log");
+    boot.takeFailureReport(RT);
+    boot.recordFailure(RT, "ui-build-failed", "vite broke", "y.log");
+    assert.match(boot.takeFailureReport(RT).systemMessage, /vite broke/);
+    boot.recordFailure(RT, "ui-build-failed", "vite broke", "y.log");
+    boot.clearFailure(RT);
+    assert.equal(boot.readFailure(RT), null);
+    assert.equal(boot.takeFailureReport(RT), null);
+  });
+
+  it("prints nothing with no failure on record", () => {
+    assert.equal(boot.takeFailureReport(RT), null);
+  });
+});
+
 describe("depsHash — only what npm installs", () => {
   function root(pkg, lock) {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), "agenthub-deps-"));