feat(sdk-ts): TypeScript plugin SDK via Javy + esbuild→wasm build pipeline

[tayebmokni]

Closes #242.

packages/ts/sdk-plugin: TypeScript SDK for GoNext plugin authors via Javy (JS→WASM).

• pluginInit + registerAction/registerFilter, async-aware dispatcher
• Typed wrappers over gn_* host ABIs via globalThis (host.kv, host.db, host.http, host.audit, host.observe, host.log, etc.)
• Manifest builder + validator mirroring gonext.io/v1
• JSON codec helpers mirroring packages/go/plugins/abi/hooks/marshal.go
• gonext-sdk-build CLI wrapping esbuild + Javy + manifest gate
• cli/gonext templates/typescript + gonext plugin init --template=typescript
• examples/plugins/sdk-ts-hello — worked plugin demonstrating action + filter + kv.set + audit.emit
• 54 Vitest unit tests (codec, manifest, dispatcher) + 7 Go tests for the init command

Test plan

• pnpm --filter @gonext/sdk-plugin test — 54 tests passing
• pnpm --filter @gonext/sdk-plugin typecheck
• go test ./cmd/plugin/... in cli/gonext — all init tests passing
• pnpm typecheck in examples/plugins/sdk-ts-hello
• gonext-sdk-build --skip-wasm against the example produces a valid dist/plugin.js + dist/manifest.json
• Full Javy compile (skipped in CI; verified locally when Javy is on PATH)

🤖 Generated with Claude Code

[github-actions]

Heads up — this PR touches strings that often signal a security disclosure (vulnerab, CVE-, exploit, bypass, or auth bypass).

If this PR fixes or describes a real vulnerability that has not yet been publicly disclosed, please stop and use the private path:

1. Open a private security advisory, or
2. Email security@gonext.io with subject [SECURITY] GoNext - <summary>.

See /SECURITY.md for the full disclosure flow and /docs/16-bug-bounty.md for bounty terms.

If this is a false positive (test fixture, doc update, release notes, etc.) please ignore this comment — the check is advisory only and does not block the PR.

Matched files:

• packages/ts/sdk-plugin/README.md