fix: make plugin release tarball paths npm 12 compatible

[superche]

Summary

• prefix local release tarballs with ./ before npm publish
• prefix registry-downloaded tarballs with ./ before npm install
• cover contracts, core, and MCP artifacts with a regression test

Why

The protected 0.3.0 release run failed before publishing because npm 12 interpreted release/pippit-bridge-contracts-0.1.0.tgz as a GitHub package spec and rejected it with EALLOWGIT.

Validation

• npm test (53 files, 395 tests passed)
• npm 12.0.1 dry-run publish of ./release/pippit-bridge-contracts-0.1.0.tgz against https://registry.npmjs.org
• git diff --check