release: fix bundled runtime packaging follow-ups

[linfangw]

Summary

• Problem: release publish/install still failed after the earlier packaging fixes because installed-package postinstall eagerly reinstalled all bundled plugin runtime deps into the package root, and staged plugin runtime deps could still include symlinked .bin shims that package-dist-inventory rejects.
• Why it matters: npm install -g during release smoke could balloon the install tree until timeout/SIGTERM, and prepack could fail on unsafe staged paths like dist/extensions/diffs/node_modules/.bin/playwright-core.
• What changed: install-time bundled runtime repair now only restores root-mirrored runtime deps that the packaged root graph actually needs, while staged plugin runtime-deps pruning now removes node_modules/.bin shim directories before packaging.
• What did NOT change (scope boundary): plugin runtime deps are still repairable through the existing doctor flow; this PR only narrows eager install behavior and removes non-runtime bin shim cargo from staged packaged artifacts.

Verification

• node scripts/run-vitest.mjs run test/scripts/postinstall-bundled-plugins.test.ts src/commands/doctor-bundled-plugin-runtime-deps.test.ts
• node scripts/run-vitest.mjs run test/scripts/stage-bundled-plugin-runtime-deps.test.ts
• commit hook pnpm check

[gemini-code-assist]

Code Review

This pull request introduces a utility to recursively prune .bin directories from node_modules during the staging of plugin runtime dependencies, along with updated tests to verify this behavior. A review comment identifies a performance optimization in the directory traversal logic, recommending the use of pop() instead of shift() to achieve O(1) complexity and the removal of a redundant null check.