perf: lighter, louder local install — vendored ReDoc, bootstrap failures shown in the session

- Plugin bootstrap: a failed npm install, a Node older than 22.5 or a failed UI
  build is recorded in runtime/last-failure.json; the next SessionStart prints
  it once as a systemMessage naming the log and /agenthub-doctor (a different
  failure is reported again; a successful bootstrap clears it). The foreground
  pass checks the Node version itself and spawns no worker on an old Node.
- ReDoc: the standalone bundle (redoc 2.5.4, MIT, licence files kept) is
  vendored under server/vendor/redoc/ and the `redoc` dependency dropped —
  a runtime install (npm ci --omit=dev --ignore-scripts) goes 126 MB -> 45 MB.
  vendor/ is excluded from the header audit and prettier.
- git missing from PATH: lane git actions answer 503 EGITMISSING with the
  install command instead of a bare ENOENT.
- package.json engines: node >=22.5.0 (node:sqlite), matching MIN_NODE.
- Docs: INSTALL.md is the one install/setup guide (SETUP.md merged in and now a
  pointer); no VS Code extension claim, one client-install hint, no
  windows-build-tools, better-sqlite3 notes scoped to checkouts, new
  "Plugin bootstrap never comes up" troubleshooting entry.

server/lib/redoc.js

@@ -2,21 +2,29 @@
  * @file Self-hosted ReDoc API reference. ReDoc renders the OpenAPI spec as a
  * clean, three-panel reference document — a read-optimized complement to
  * Swagger UI's interactive "try it out" console (both are served from the same
- * `/api/openapi.json` spec). The ReDoc bundle ships with the `redoc`
- * dependency and is served straight from `node_modules` rather than a CDN, so
- * the docs render fully offline / air-gapped, consistent with the project's
- * no-external-assets policy.
+ * `/api/openapi.json` spec). The ReDoc bundle is served from the repo itself
+ * rather than a CDN, so the docs render fully offline / air-gapped, consistent
+ * with the project's no-external-assets policy.
+ *
+ * The bundle is VENDORED (`server/vendor/redoc/`): `redoc.standalone.js` from
+ * the `redoc` npm package 2.5.4, byte-for-byte, with its MIT `LICENSE` and the
+ * bundled libraries' `redoc.standalone.js.LICENSE.txt`. The `redoc` package
+ * itself is not a dependency — the server only ever serves this one browser
+ * file, and the package pulled ~25 MB of Node-side dependencies into every
+ * runtime install. To update: `npm pack redoc@<version>`, copy
+ * `package/bundles/redoc.standalone.js` (+ `.LICENSE.txt`) over these files and
+ * bump the version named here.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
+const path = require("path");
+
 /**
- * Absolute path to the prebuilt ReDoc standalone bundle inside the installed
- * `redoc` package. Resolved through Node's module resolution so it works
- * regardless of hoisting / install layout. Throws if `redoc` is not installed.
+ * Absolute path to the vendored ReDoc standalone bundle.
  * @returns {string}
  */
 function redocBundlePath() {
-  return require.resolve("redoc/bundles/redoc.standalone.js");
+  return path.join(__dirname, "..", "vendor", "redoc", "redoc.standalone.js");
 }
 
 /**