feat(sdk): punktfunk-scripting — the managed script/plugin runner (M5)

The optional supervision layer (RFC §8): one service runs everything in
<config_dir>/scripts/ plus installed punktfunk-plugin-* packages
(<config_dir>/plugins/node_modules/), as Effect fibers.

- Plugins (a definePlugin default export, either main shape) are
  SUPERVISED: a failure restarts them with capped exponential backoff
  (jittered, 1s→60s); a clean return completes them. The Effect shape
  runs under the PunktfunkHost layer; the async-fn shape gets a facade
  client whose close is scope-guaranteed.
- Bare scripts are one-shot: importing them is the run, no restart
  (export a plugin to be supervised).
- Shutdown is STRUCTURAL: SIGINT/SIGTERM interrupt the whole fiber tree,
  so Effect plugins' scoped finalizers run and clients close before
  exit — the systemctl-stop story, and the reason the Effect plugin
  shape exists at all.
- The sshd rule applies to unit files (world-writable → refused loudly);
  cache-busted imports make restarts real; --list for inventory.

6 new bun tests (17 total green): discovery + refusal, both plugin
shapes against a mock host, crash→restart with backoff, one-shot
semantics, and finalizer-on-interrupt. Live-verified against a real
host: a supervised watcher plugin received library.changed through the
pinned tunnel, and SIGTERM shut the tree down structurally (exit 0).

Deferred to the packaging follow-up (release.yml is in flight in a
parallel session): the vendored-Bun deb/rpm/iss packages and the
host-log-ring tee (needs a host ingest endpoint); console page rides
the other console surfaces.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs-site/content/docs/automation.md

@@ -138,6 +138,15 @@ curl -Nk -H "Authorization: Bearer $(cat ~/.config/punktfunk/mgmt-token)" \
   `event: dropped` frame first — resync from the REST snapshots (`/status`, `/clients`, …).
 - `?kinds=` filters server-side: exact kinds or `domain.*` prefixes, comma-separated.
 
+## Scripts, plugins, and the runner
+
+For anything beyond a `curl` one-liner there is **`@punktfunk/host`** — the TypeScript SDK
+(`sdk/` in the repo): typed events with automatic reconnect/resume, the REST surface, and a
+plugin convention (`punktfunk-plugin-*`). Its **runner** (`punktfunk-scripting`) supervises a
+directory of scripts and installed plugins as one service: crash-restarts with backoff, and a
+`systemctl stop` that interrupts plugins structurally so their cleanup runs. See the SDK README
+for the five-line quickstart and unit templates.
+
 The canonical "decide, don't just observe" pattern — approve pairing from your phone: watch
 `pairing.pending`, send yourself a notification, and call
 `POST /api/v1/native/pending/{id}/approve` when you tap yes. The full API is documented at