Ship prebuilt, so a git URL is the whole install

Grok Build loads plugins out of ~/.grok/plugins/ and clones marketplace sources
straight from git; it never runs npm install or a build for you. So a plugin that
ships TypeScript is a plugin you have to build by hand before it does anything,
and the SessionStart hook's first act is to print "not built yet".

dist/ is now committed, and the tree is arranged so that a bare clone can run:

- The daemon is bundled to a single ESM file with rolldown, platform node. Its one
  runtime dependency (@simplewebauthn/server, plus the asn1/cbor tree under it) is
  inlined; the only imports left in the output are node: builtins. Not minified —
  a committed blob nobody can read is worse than no committed blob.
- tsc no longer emits for the server, it only typechecks (noEmit). rolldown emits.
- dist/web was already a self-contained static bundle.
- The hook scripts under bin/ were stdlib-only from the start.

.grok-plugin/marketplace.json makes the repo its own one-entry catalog with a local
source of "./", so `grok plugin marketplace add <git-url>` followed by
`grok plugin install grok-glance` works without pinning a SHA of itself.

`npm run check:dist` rebuilds and fails if the committed output is stale — the one
real hazard of checking in build output.

Also drops the daemon's "non-default port, run `glance sync-hooks`" startup note,
which the previous commit should have taken with the rest of that scheme; the hook
scripts read config.json themselves, so a non-default port needs nothing.

The e2e suite now takes GLANCE_ROOT and was run twice: once against the repo, once
against a copy containing only tracked files plus dist/ and no node_modules — which
is what actually demonstrates the claim, passkey registration and assertion
included. 233 checks, both runs green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -37,49 +37,63 @@ or drive a session.
 
 ## Requirements
 
-- Node.js 20 or newer, and npm.
+- Node.js 20 or newer. **npm is only needed to develop it** — `dist/` is committed, and the
+  daemon bundle carries its one runtime dependency inside it, so an installed copy never runs
+  a build or an install step.
 - Grok Build.
 - For phone access: [Tailscale](https://tailscale.com/) on both the machine and the phone. See
   [Why Tailscale](#why-tailscale-and-not-just-the-lan-ip) — a LAN IP genuinely cannot work.
 
 ## Install
 
+Grok Build loads plugins straight out of `~/.grok/plugins/`, so the shortest install is a clone:
+
 ```sh
-git clone <this repo> grok-glance
-cd grok-glance
-npm install && npm run build
+git clone <this repo> ~/.grok/plugins/grok-glance
 ```
 
-The build produces `dist/server` (the daemon) and `dist/web` (the dashboard). Both are required;
-the daemon serves the dashboard itself. `hooks/hooks.json` is checked in as-is — nothing about it
-is generated or machine-specific. The shared secret the hook scripts authenticate with lives in
-`~/.grok/glance/hook.secret` (mode 0600) and is created by the daemon on first start; it never
-appears in `hooks.json`.
+That is the whole thing — no `npm install`, no build. Open `/plugins` in Grok Build and enable
+**grok-glance**. On the next session start its `SessionStart` hook boots the daemon in the
+background, and the dashboard is on `http://127.0.0.1:8791`.
 
-Then register the directory with Grok Build. Plugins are installed from a marketplace catalog, so
-for a local checkout the shortest path is a one-entry catalog. Create
-`.grok-plugin/marketplace.json` in a directory that contains your checkout:
+### …or from a marketplace, by URL
 
-```json
-{
-  "name": "local",
-  "description": "Local plugins",
-  "owner": { "name": "me" },
-  "plugins": [
-    {
-      "name": "grok-glance",
-      "description": "Passkey-guarded phone dashboard for Grok Build.",
-      "category": "monitoring",
-      "source": { "type": "local", "path": "./grok-glance" }
-    }
-  ]
-}
+If you would rather install it the way marketplace plugins are installed — or share it with other
+machines — this repo is also its own one-entry marketplace (`.grok-plugin/marketplace.json`). Add
+it as a marketplace source and install from it:
+
+```sh
+grok plugin marketplace add https://your-git-host/you/grok-glance.git
+grok plugin install grok-glance --trust
 ```
 
-…then add that marketplace and install `grok-glance` from Grok Build's `/plugin` interface.
+Marketplace sources also live in `~/.grok/config.toml` under `[[marketplace.sources]]` and in
+`~/.grok/plugins/known_marketplaces.json`, if you prefer to write them there directly. The TUI's
+Marketplace tab reads the same list.
 
-Once installed, the daemon starts by itself: the `SessionStart` hook boots it in the background on
-the first session after installation.
+### Why there is no build step
+
+`dist/` is checked in:
+
+- `dist/server/index.js` — the daemon, bundled to a single dependency-free ESM file. Its only
+  runtime dependency, `@simplewebauthn/server`, is inlined; everything else it uses is the Node
+  standard library. It is *not* minified, so what ships is what you can read.
+- `dist/web/` — the dashboard, already a static bundle, which the daemon serves itself.
+
+The hook scripts under `bin/` were stdlib-only from the start. So a clone has nothing to resolve
+and nothing to compile, which is what makes a bare git URL enough.
+
+Working on it instead? Then you do need the toolchain:
+
+```sh
+npm install
+npm run build        # tsc typechecks, rolldown bundles the server, vite builds the web app
+npm run check:dist   # rebuilds and fails if the committed dist/ is stale
+```
+
+`hooks/hooks.json` is checked in as-is — nothing about it is generated or machine-specific. The
+shared secret the hook scripts authenticate with lives in `~/.grok/glance/hook.secret` (mode 0600)
+and is created by the daemon on first start; it never appears in `hooks.json`.
 
 ## Get it onto your phone