[codex] Run bundle canaries after build

[arapov]

Summary

Follow-up from the beta.4 observability review. I found one real CI coverage gap plus stale release docs/dependency hygiene:

• tests/bundle-shape.test.ts was meant to guard the generated dist/ artifacts, but CI ran npm test before npm run build, so the test skipped on clean checkouts where dist/ is ignored.
• HOWTO still showed the pre-observability test count and bundle sizes.
• scripts/wire-trace-tasks.sh referenced a non-existent smoke-test.sh instead of the HOWTO smoke.sh snippet.
• npm outdated reported direct dev dependency @types/node 25.9.0 -> 25.9.1.

Changes

• Move GitHub Actions build before test so bundle-shape canaries exercise dist/.
• Update HOWTO gate order, test count, and bundle sizes.
• Correct task wire-trace comments to point at the HOWTO smoke snippet.
• Update @types/node to 25.9.1.
• Add an Unreleased changelog entry for the review fixes.

Validation

• npm install --cache /private/tmp/capsulemcp-npm-cache
• npm run typecheck
• npm run check
• npm run build (dist/index.js 144.74 KB, dist/http.js 170.83 KB)
• npm test (37 files, 460 tests)
• npm audit --audit-level=low --cache /private/tmp/capsulemcp-npm-cache (0 vulnerabilities)
• npm outdated --json --cache /private/tmp/capsulemcp-npm-cache ({})
• npm pack --dry-run --json --cache /private/tmp/capsulemcp-npm-cache
• git diff --check HEAD