build: ship sl0pstatus, and install every plugin the package carries

Phase 3: `make package` now produces a tarball that provably works on a machine
with no node, npm, bun or rust.

Two bugs the clean-room test found, neither visible until a session actually
started:

  - the default layout builds its status bar out of zjstatus, which we were not
    shipping at all (vendored as sl0pstatus/ in the preceding commits)
  - install.sh installed a hardcoded plugin list, so zjstatus.wasm would not
    have reached the config dir even once staged

Also: layouts/*.kdl still pointed at ~/.config/zellij, missed by the rename pass
because that pass only rewrote config.kdl.

Verified end to end, from the tarball, in a throwaway HOME with node/npm/bun/
cargo shadowed by stubs that fail loudly if invoked:

  sl0ppij --version        -> sl0ppij 0.45.0+sl0p1
  pi --version             -> 0.84.1        (on the bundled bun)
  pir --help               -> ok
  sl0ppij -s realtest      -> session starts under a pty, config "Well defined",
                              fork pane titles render, both wasm plugins load,
                              no errors beyond the first-run permission cache

Artifact: sl0ppi-0.1.0-x86_64-linux.tar.gz, 83M, + .sha256.

1 files changed, 35 insertions, 8 deletions

diff --git a/docs/roadmap.md b/docs/roadmap.md
index 7a7bf1f..e5964d6 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -30,18 +30,45 @@ Left for later (both need work disproportionate to their value right now):
 - [ ] decide whether the opinionated defaults are also *compiled in* as
       fallbacks, so a bare `sl0ppij` with no config dir still looks right
 
-## Phase 3 — prove the artifact
+## Phase 3 — prove the artifact ✅
 
-- [ ] `make package` end to end (needs a release build; see "Disk" below)
-- [ ] install the tarball into a throwaway `HOME` and smoke-test:
-      session starts, theme+layout apply, pane-finder plugin loads, `pi` runs on
-      the bundled runtime, OSC 5577 frames render, `pir` resumes
-- [ ] decide `gnu` vs `musl` for the release target. The fork's toolchain
-      already lists `x86_64-unknown-linux-musl`; static musl is the better
-      "runs on any box" story and should probably become the default.
+- [x] `make package` end to end → `sl0ppi-0.1.0-x86_64-linux.tar.gz` (83M,
+      328M staged) + sha256
+- [x] installed into a throwaway `HOME` on a minimal PATH **with `node`, `npm`,
+      `bun`, `cargo` replaced by poison stubs that fail loudly**: `sl0ppij`,
+      `pi` (0.84.1, on the bundled bun) and `pir` all run. Nothing reached for a
+      system runtime.
+- [x] real session started under a pty from the installed tree: config loads
+      ("Well defined"), layout + fork pane titles render, both wasm plugins
+      load. Only log line on a fresh profile is the benign "permission cache
+      file not found".
+- [x] **found and fixed two real packaging bugs** (see below)
+- [ ] decide `gnu` vs `musl` for the release target. Currently `gnu`, so the
+      binary inherits this box's glibc floor. The fork's toolchain already lists
+      `x86_64-unknown-linux-musl`; static musl is the better "runs on any box"
+      story and should probably become the default before anyone else installs
+      this.
 - [ ] optional: `bun build --compile` pi into a single executable instead of
       shipping 183M of `node_modules` — but only if runtime-loaded `.ts`
       extensions still work in a compiled bundle. Test before committing to it.
+- [ ] optional: pre-seed the plugin permission cache so a fresh install does not
+      open on a "Allow? (y/n)" prompt.
+
+### What the smoke test caught
+
+Both were invisible to `make package` and to any amount of reading:
+
+1. **`zjstatus` was missing entirely.** The config snapshot commit dropped it as
+   "a third-party blob no longer referenced by config.kdl" — true of `config.kdl`,
+   false of `layouts/default.kdl`, which builds the whole status bar out of it.
+   It turned out to be a *third fork* (`sl0pstatus/`, now vendored) whose live
+   `.wasm` was a custom build. Sessions started with a plugin load error.
+2. **`install.sh` installed a hardcoded plugin list**, so even once staged,
+   `zjstatus.wasm` never reached the config dir. Now it installs whatever the
+   package contains.
+
+Both failure modes only appear *after* a session starts, which is the argument
+for keeping the clean-room session test in the release routine.
 
 ## Phase 4 — the `sl0ppi` CLI