fix(plugin): build the native runtime without the SDK

[mldangelo-oai]

Summary

A checkout containing only the plugin could not build its native runtime because the SDK compiled the build tools. The plugin can now compile and package the runtime using its own dependencies, and the documented output works with the plugin launcher.

Changes

• Add a plugin build script that compiles the TypeScript tools, builds the Rust binary with locked dependencies, and generates license notices.
• Add --native host to the MCP build. It packages the current host binary and rejects unsupported targets before changing the output. Document and ignore the launcher's mcp/ directory.
• Add Linux, macOS, and Windows CI that loads the packaged binary and runs the native tests with an empty PATH, then invokes the plugin launcher.
• Give both baseline-preparation test cases distinct names in Bun’s JUnit reports so CI can compare runner inventories.

Testing

• Standalone CI passed on Linux, macOS, and Windows. The documented build and launcher also passed locally on macOS arm64. The unsupported-target test failed as expected with the previous builder.
• All 46 MCP tests, 301 workflow tests, and 9 portable-source checker tests passed. Typechecks, formatting, Ruff, the CI TypeScript build, and the portable-source check also passed.
• The default universal build passed; all 19 output files, including eight native binaries, matched the previous builder byte for byte.
• CI follow-up: all 66 CLI patch tests passed on Bun 1.3.13 in baseline, isolated, and parallel modes; the CI comparator reported identical inventories and outcomes for both comparisons.

Risk and rollout

Plugin and npm releases still default to --native universal and require the same eight verified binaries. Host output is specific to the current platform, architecture, and Linux C library where applicable. No Rust runtime code or dependency lockfiles changed.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-18T21:40:19.558347Z	a556cb7	New commits
🔒 Security Review	✅ Completed 2026-09-18T21:41:11.229735Z	a556cb7	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.