Why a lockfile-only dep bump drifts the build

Dependabot bumped esbuild 0.28.0 → 0.28.1 (GHSA-gv7w / GHSA-g7r4) across docs/site + src/mcp-server. It only edits lockfiles — but build-plugins.sh bundles src/mcp-server via esbuild into a committed artifact. Toggle below to see why CI's drift gate fails on the bare bump, and what this PR adds.

The fix mirrors #2436 (src/hooks esbuild patch). src/mcp-server isn't in the npm-audit gate and the advisory is build-time-only / non-applicable to ork's usage, so urgency is hygiene — but the committed bundle must match a fresh build or the drift gate (correctly) blocks merge.