Publish Sage app SDK through trusted npm CI

[Rigidity]

Summary

• prepare sage-app-sdk for public npm distribution with package metadata, documentation, and complete exports
• flatten workspace package names and update all internal imports and dependencies
• add trusted npm publishing on Sage tags plus package dry runs on main and pull requests

Test plan

• pnpm build:packages
• pnpm prettier:check
• pnpm lint
• npm pack --dry-run in packages/sage-app-sdk
• Confirm the npm workflow dry run passes on this PR

---

Note

Medium Risk
Wide import and package-name churn can break builds or external consumers still on @sage-app/* scopes; tag-triggered npm publish affects public package availability.

Overview
Prepares sage-app-sdk for public npm release (Apache-2.0 LICENSE, README, registry metadata, publishConfig.access: public, prepack build, and a bridge-runtime-core tsup entry) and wires trusted publishing via a new .github/workflows/npm.yml that runs prettier, lint, and npm pack --dry-run on PRs/main and npm publish from packages/sage-app-sdk on any tag ( environment: npm, OIDC id-token: write).

Renames workspace packages from scoped names to sage-app-sdk, sage-app-ui, and sage-system-app-sdk, updating root/builtin-app package.json scripts, pnpm-lock, TS path aliases, CSS theme imports, and docs so the monorepo resolves the new names consistently.

^{Reviewed by Cursor Bugbot for commit c1d7976. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 46b2b7f. Configure here.}