feat(plugins): make CCAM installable straight from a Claude Code plugin

Adds a root `ccam` plugin (`.claude-plugin/plugin.json`, `"source": "./"`) so
`/plugin marketplace add` + `/plugin install ccam@...` is enough on a machine
with nothing but Claude Code: no clone, no npm run setup, no manual npm start.

- scripts/plugin-bootstrap.js: SessionStart hook. Fast-path exit, Node >=22.5
  gate (node:sqlite), mkdir lock with stale reclaim, deps installed into
  ~/.claude/agent-dashboard/runtime/ (never the plugin cache), legacy
  checkout-hook cleanup (backed up), ~/.local/bin/ccam launcher, eager UI
  build so client routes like /run work immediately, detached server spawn.
- scripts/plugin-open.js, scripts/plugin-doctor.js: /ccam-open, /ccam-doctor.
- server/index.js: DASHBOARD_CLIENT_DIST override (plugin cache is read-only).
- mcp/build/ is committed (plugin MCP servers start before any bootstrap could
  build them) and kept honest by scripts/check-mcp-build.js (content hash,
  not mtime), enforced by pre-commit when mcp/src changes.
- plugins/ccam-dashboard/.mcp.json moved under plugins/ccam/ with a working
  ${CLAUDE_PLUGIN_ROOT} path (the old relative path never resolved from a
  marketplace-cached subdir).
- Docs: README, INSTALL, SETUP, ARCHITECTURE, CLAUDE.md, docs/PLUGINS.md,
  docs/MCP.md, docs/CLI.md, docs/HOOKS.md.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

docs/MCP.md

@@ -135,13 +135,35 @@ graph TB
 # Install MCP server dependencies
 npm run mcp:install
 
-# Build MCP server
+# Build MCP server (also stamps mcp/build/.srchash)
 npm run mcp:build
 
 # Test MCP server
 npm run mcp:start
 ```
 
+Installing the `ccam` plugin needs none of this: it ships the built server and
+wires it up itself (see [PLUGINS.md](PLUGINS.md)).
+
+### Why `mcp/build/` is committed
+
+Claude Code starts a plugin's MCP servers the moment a session opens and offers
+no "not ready yet, retry" state, so an async bootstrap cannot win that race. The
+build artifact is therefore committed, and `plugins/ccam/.mcp.json` points at
+`${CLAUDE_PLUGIN_ROOT}/mcp/build/index.js`.
+
+The cost is drift, so freshness is enforced by content hash — `mcp/src` plus the
+MCP manifests and tsconfig are hashed into `mcp/build/.srchash`:
+
+```bash
+npm run mcp:check-build   # fails when mcp/build is stale or unstamped
+```
+
+`npm run mcp:build` re-stamps it, the pre-commit hook runs the check whenever
+`mcp/src` is part of the commit, and `/ccam-doctor` reports it. Modification
+times are deliberately not used: a fresh clone stamps every file at checkout
+time in arbitrary order.
+
 ### Directory Structure
 
 ```
@@ -157,7 +179,8 @@ mcp/
 │   │   └── stats.ts          # Statistics tools
 │   └── types.ts              # TypeScript type definitions
 │
-├── dist/                     # Compiled JavaScript (gitignored)
+├── build/                    # Compiled JavaScript (COMMITTED — see above)
+│   └── .srchash              # hash of mcp/src the build was produced from
 ├── package.json
 ├── tsconfig.json
 └── README.md