perf: lighter, louder local install — vendored ReDoc, bootstrap failures shown in the session

- Plugin bootstrap: a failed npm install, a Node older than 22.5 or a failed UI
  build is recorded in runtime/last-failure.json; the next SessionStart prints
  it once as a systemMessage naming the log and /agenthub-doctor (a different
  failure is reported again; a successful bootstrap clears it). The foreground
  pass checks the Node version itself and spawns no worker on an old Node.
- ReDoc: the standalone bundle (redoc 2.5.4, MIT, licence files kept) is
  vendored under server/vendor/redoc/ and the `redoc` dependency dropped —
  a runtime install (npm ci --omit=dev --ignore-scripts) goes 126 MB -> 45 MB.
  vendor/ is excluded from the header audit and prettier.
- git missing from PATH: lane git actions answer 503 EGITMISSING with the
  install command instead of a bare ENOENT.
- package.json engines: node >=22.5.0 (node:sqlite), matching MIN_NODE.
- Docs: INSTALL.md is the one install/setup guide (SETUP.md merged in and now a
  pointer); no VS Code extension claim, one client-install hint, no
  windows-build-tools, better-sqlite3 notes scoped to checkouts, new
  "Plugin bootstrap never comes up" troubleshooting entry.

skills/file-headers/scripts/check-headers.sh

@@ -11,7 +11,8 @@
 # are still audited, so a file an agent just wrote is caught before it is
 # staged. The extra excludes below are for paths git DOES track (or would list)
 # but the rule exempts — notably generated bundles, which are still
-# generated tsc output, and snapshots.
+# generated tsc output, snapshots, and third-party files vendored under a
+# `vendor/` directory (e.g. server/vendor/redoc/), which keep their own licence banner.
 # @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 
 set -euo pipefail
@@ -34,7 +35,7 @@ while IFS= read -r f; do
 done < <(
   git -C "$ROOT" ls-files --cached --others --exclude-standard |
     grep -E '\.(js|ts|tsx|cjs|mjs|py|sh|css)$' |
-    grep -vE '\.min\.js$|(^|/)(__snapshots__|node_modules|dist|build)/|^(data|monitoring/\.(bin|data))/' || true
+    grep -vE '\.min\.js$|(^|/)(__snapshots__|node_modules|dist|build|vendor)/|^(data|monitoring/\.(bin|data))/' || true
 )
 
 if [ "$missing" -eq 0 ]; then