fix(package): make OpenCode alpha installable

[hopeatina]

Root cause

0.1.0-alpha.16 published @useorgx/orgx-gateway-sdk as a Git dependency. OpenCode 1.16.2 accepted the plugin config but failed its clean-home package preparation with:

service=plugin pkg=@useorgx/orgx-opencode-plugin version=alpha error=git dep preparation failed failed to install plugin

The exact SDK commit is now published as @useorgx/orgx-gateway-sdk@0.1.0-alpha.12.

Change

• bump plugin and manifest to 0.1.0-alpha.17
• replace the Git dependency with exact npm version 0.1.0-alpha.12
• lock the registry tarball and integrity
• add an install contract that rejects Git/local runtime dependencies before release
• update the version-bearing heartbeat assertion

Verification

• npm ci --ignore-scripts --no-audit --no-fund
• npm run type-check
• npm test: 123/123 Vitest and 9/9 Node contract/reconciler tests
• npm run build
• npm run pack: 84.2 kB, 83 files
• packed manifest readback: alpha.17 + exact registry SDK alpha.12, no Git/local dependency specifier
• negative canary: restoring the alpha.16 Git spec makes the new focused contract fail with the exact unsafe dependency; restored contract passes 2/2
• clean temp-home runtime: Bun 1.3.8 installed the packed alpha.17 plus SDK alpha.12; OpenCode 1.16.2 reached healthy; project bootstrap loaded the installed plugin entry point without a plugin error

A direct file: URL to a .tgz is not an OpenCode plugin entry and was not treated as a success. The final production receipt remains a clean-home @alpha load after alpha.17 is published.

Rollout

Do not publish from this PR branch. Merge only after required CI passes, then publish alpha.17, read back the registry tag/version, and run the clean-home @alpha canary before releasing Wizard 0.1.74.