Ship prebuilt, so a git URL is the whole install

Grok Build loads plugins out of ~/.grok/plugins/ and clones marketplace sources
straight from git; it never runs npm install or a build for you. So a plugin that
ships TypeScript is a plugin you have to build by hand before it does anything,
and the SessionStart hook's first act is to print "not built yet".

dist/ is now committed, and the tree is arranged so that a bare clone can run:

- The daemon is bundled to a single ESM file with rolldown, platform node. Its one
  runtime dependency (@simplewebauthn/server, plus the asn1/cbor tree under it) is
  inlined; the only imports left in the output are node: builtins. Not minified —
  a committed blob nobody can read is worse than no committed blob.
- tsc no longer emits for the server, it only typechecks (noEmit). rolldown emits.
- dist/web was already a self-contained static bundle.
- The hook scripts under bin/ were stdlib-only from the start.

.grok-plugin/marketplace.json makes the repo its own one-entry catalog with a local
source of "./", so `grok plugin marketplace add <git-url>` followed by
`grok plugin install grok-glance` works without pinning a SHA of itself.

`npm run check:dist` rebuilds and fails if the committed output is stale — the one
real hazard of checking in build output.

Also drops the daemon's "non-default port, run `glance sync-hooks`" startup note,
which the previous commit should have taken with the rest of that scheme; the hook
scripts read config.json themselves, so a non-default port needs nothing.

The e2e suite now takes GLANCE_ROOT and was run twice: once against the repo, once
against a copy containing only tracked files plus dist/ and no node_modules — which
is what actually demonstrates the claim, passkey registration and assertion
included. 233 checks, both runs green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/src/index.ts

@@ -18,7 +18,6 @@ import http from "node:http";
 import crypto from "node:crypto";
 import { URL } from "node:url";
 import {
-  DEFAULT_PORT,
   VERSION,
   deriveRpId,
   ensureHome,
@@ -564,8 +563,9 @@ server.listen(cfg.port, cfg.host, () => {
   console.log(`[glance] state: ${paths.home}`);
   console.log(`[glance] origin: ${cfg.origin ?? "(none set - see README)"} rpId: ${cfg.rpId ?? "localhost"}`);
   console.log(`[glance] accepts assertions from: ${expectedOrigins(cfg).join(", ")}`);
-  if (!webBuildExists()) console.log("[glance] web app not built yet: npm install && npm run build");
-  if (cfg.port !== DEFAULT_PORT) console.log(`[glance] note: non-default port, run \`glance sync-hooks\``);
+  // dist/ is committed, so this only fires for a developer who deleted it. Nothing warns about a
+  // non-default port any more: the hook scripts read config.json themselves.
+  if (!webBuildExists()) console.log("[glance] web app missing from dist/: npm install && npm run build");
 });
 
 server.on("error", (err) => {

server/src/static.ts

@@ -32,7 +32,7 @@ export function webBuildExists(): boolean {
 export function serveStatic(urlPath: string, res: ServerResponse): void {
   if (!webBuildExists()) {
     res.writeHead(503, { ...SECURITY_HEADERS, "content-type": "text/plain; charset=utf-8" });
-    res.end("grok-glance: web app not built yet. Run `npm install && npm run build`.\n");
+    res.end("grok-glance: dist/web is missing. Run `npm install && npm run build`.\n");
     return;
   }