chore: follow the vibecook-dev transfer and consume Ghosttea from npm

[jamesyong-42]

Two independent fixes, one per commit, both fallout from recent repo transfers.

chore: follow the repository transfer

The repo moved jamesyong-42/chopsticks → vibecook-dev/chopsticks. Git kept working through GitHub's redirect and CI stayed green, so 17 stale references went unnoticed.

The load-bearing one was scripts/trust-packages.mjs. npm trusted publishing binds to a literal owner/repo on the registry side — it doesn't follow a transfer and isn't stored in the repo. Actions now mints OIDC tokens claiming vibecook-dev/chopsticks, which matched no binding, so the next release would have failed at publish with no missing secret to explain it.

The nine registry-side bindings have already been re-pointed out of band and verified:

Repository	vibecook-dev/chopsticks (all 9)
Workflow	release.yml
Permission	createPackage
Stale jamesyong-42 entries	0

CHANGELOG.md links are deliberately untouched — they redirect, and release-please generates new ones from GITHUB_REPOSITORY.

build(apps): consume Ghosttea from npm

The sibling was transferred to vibecook-dev/ghosttea and renamed every package directory after what it publishes (terminal-* → ghosttea-*). Both apps still pointed at packages/terminal-*, so all ten references — five file: deps per app plus the link: overrides — resolved to directories that no longer exist, and the node_modules symlinks dangled. The apps were already broken before this PR.

Pinned to exact 0.4.0 from the registry instead. The only commits touching the sibling's packages/ since its v0.4.0 tag are that rename and its own transfer chore, so the published tarballs are equivalent to the local checkout.

• minimumReleaseAgeExclude moves to 0.4.0; those versions are days old and the supply-chain policy rejects them otherwise
• build.mjs resolves bridge-entry through the package exports map rather than a source-tree path
• the redundant build:sdk half of prebundle is dropped — the npm tarballs ship prebuilt dist/

The remaining ghostteaRoot paths are deliberate and now carry a comment saying so: the native tabs addon and the cargo-built ghosttead daemon live in the sibling's app, not its packages, so neither is on npm and both still need the local checkout. GHOSTTEAD_BIN overrides the daemon.

Verification

Local, since CI only covers packages/**:

• pnpm test — exit 0, fail 0
• pnpm format:check, pnpm pack:check — both pass
• both apps typecheck and bundle, with bridge-entry.js, terminal-render.worker.js, and dist/native/ghosttea_native_tabs.node all staged

Merge order

Worth landing before release PR #4. That PR predates this work, so merging it first would publish 0.1.4 with the old jamesyong-42 URLs baked into every package's repository metadata and provenance.

🤖 Generated with Claude Code