chore: complete package.json metadata and guard against publish

[MANVENDRA-github]

What was missing

$ node -e "..."
  repository  : MISSING
  bugs        : MISSING
  homepage    : MISSING
  author      : MISSING
  private     : NOT SET

In descending order of how much each matters:

• No private: true. agentry installs by clone, never from a registry (D12/D21) — there is no npm package and there is not meant to be one. A stray npm publish would upload the whole repo under the unclaimed name agentry. npm refuses to publish a package marked private.
• No repository. Tooling that resolves a project's source from its manifest — and anyone who opens package.json before the README — had nothing to follow.
• No bugs / homepage. Now the issue tracker and the README.
• keywords omitted opencode and mcp — one of the four harnesses and one of the six source types.

The trap I avoided

PR #29 made package.json the single source for the manifest's version, description, and license, and its commit message says:

Author stays literal; package.json has no author field.

Adding an author field without wiring it would recreate the exact two-source drift #29 removed. So this derives name and author from package.json too:

const manifest = {
  name: pkg.name,
  version: pkg.version,
  description: pkg.description,
  author: pkg.author,
  license: pkg.license,
};

$ grep -nE '"agentry"|"MANVENDRA-github"|"MIT"' scripts/sync-harnesses.js
(none)

No project metadata is hardcoded in scripts/ any more.

Verification

The author value is unchanged, so the generated manifest must be byte-identical. It is:

$ before=$(cat .claude-plugin/plugin.json); npm run sync; after=$(cat .claude-plugin/plugin.json)
plugin.json: byte-identical

{"name":"agentry","version":"0.15.0","description":"Author your AI coding agents and skills
once. Sync them to every harness you use.","author":"MANVENDRA-github","license":"MIT"}

$ npm run lint   # PASS
$ npm test       # 239 pass, 0 fail
$ npm run sync   # clean, no drift

One claim I could not verify empirically. npm publish --dry-run exits 0 even with private: true — dry-run does not perform the private check, so it proves nothing here. I did not run a real npm publish to test the guard. That npm refuses a private package with EPRIVATE is documented behavior, not something this PR demonstrates.