FN-5842: publish plugin SDK subpath export

Expose the plugin SDK as a published CLI subpath while preserving existing workspace behavior.

- add a prepack transform helper that injects the ./plugin-sdk and ./package.json exports only in packed manifests
- split tsup config into dedicated CLI and plugin-sdk builds so dist/plugin-sdk JS and DTS are emitted with @fusion deps inlined
- add coverage for definePlugin/validatePluginManifest behavior and manifest/build export guarantees
- document the new published @runfusion/fusion/plugin-sdk surface for plugin authors

Files changed:
 docs/agents.md                                     |  2 +
 packages/cli/scripts/prepare-publish-manifest.mjs  | 61 +++++++++++++++-------
 packages/cli/src/__tests__/plugin-sdk-export.test.ts| 50 ++++++++++++++++++
 packages/cli/tsup.config.ts                        | 31 +++++++++--
 4 files changed, 121 insertions(+), 23 deletions(-)

Fusion-Task-Id: FN-5842

Fusion-Task-Lineage: b6b481ae-aaac-46c0-a6f7-8cc1e9eed1ce

docs/agents.md

@@ -1494,6 +1494,8 @@ The pi extension ships as part of `@runfusion/fusion` and provides tools + a `/f
 
 The extension has no skills — tool descriptions give the LLM everything it needs.
 
+Published SDK surface: `@runfusion/fusion/plugin-sdk` now ships as a public subpath export from the CLI package, exposing `definePlugin`, `validatePluginManifest`, and the plugin type surface for external plugin authors without depending on private `@fusion/*` workspace packages.
+
 ### `fn_web_fetch`
 
 Lightweight URL read from agent/chat sessions. HTTP GET, follows redirects, extracts readable text (HTML→text and JSON pretty-print), bounded.