fix(ci): build dist via prepare so socket-registry install can resolve self-import

The reusable CI workflow's setup-and-install action (bumped to
13684cd8 in c962821) now provisions ecc-agentshield by invoking
`node -e "import { downloadPackage } from '@socketsecurity/lib/dlx/package'"`
right after `pnpm install`. For socket-lib itself this path resolves
to ./dist/dlx/package.js via the package's own exports map — but
dist/ doesn't exist before the build step runs, so the import throws
ERR_MODULE_NOT_FOUND and the Check + Test (Isolated) jobs fail.

(Matrix test cells skip the agentshield install via
`if: strategy.job-total < 2`, so they continued to pass. The breakage
was scoped to single-job invocations of setup-and-install.)

Build dist as part of the root prepare script. pnpm runs prepare
for the workspace root after pnpm install (the root project's
ignore-scripts=true only affects deps), so dist/ is in place before
any subsequent action step tries to import @socketsecurity/lib/*.
The build itself still imports from @socketsecurity/lib-stable
(npm:@socketsecurity/lib@5.24.0, already in devDependencies), so
there is no chicken-and-egg in prepare.

Cost: ~3s added to every pnpm install (acceptable for a build
that was already required before publish via prepublishOnly).

Author: jdalton

package.json

@@ -700,7 +700,7 @@
     "fix": "node scripts/fix.mts",
     "lint": "node scripts/lint.mts",
     "security": "agentshield scan && { command -v zizmor >/dev/null && zizmor .github/ || echo 'zizmor not installed — run pnpm run setup to install'; }",
-    "prepare": "husky",
+    "prepare": "husky && node scripts/build/main.mts --quiet",
     "prepublishOnly": "pnpm run build",
     "test": "node scripts/test/main.mts",
     "update": "node scripts/update.mts"