VoiceOS integration Publish ships only five files, so bundle deps

In VoiceOS custom integrations (local-mcp), the Studio-generated AGENTS.md says Publish ships only server.ts, widgetKit.ts, voiceos.integration.json, package.json and icon.png. A teammate's install from the share link has no node_modules, and Bun's auto-install resolves bare imports to their latest versions (it fails on pinned ones). Keep runtime code in one server.ts, or write src/ modules and bundle them into server.ts with Bun.build. The share review rejects code compiled from strings, so patch out zod 4's new Function fast path and the MCP SDK's ajv validator in the bundle; it also rejects keys in the manifest. Manifest gotchas from the reference: permissions is an array of {kind: network|background|notify} with no filesystem permission; setup fields are preferences; long tools need execution.mode 'background' plus the background permission.