feat(sdk-typescript): add download methods, remove dead code

[shwetank-dev]

Summary

Adds three new public methods to MpakClient for downloading bundles and skills with SHA-256 integrity verification. Removes dead code that was not used by the CLI or any external consumer.

New methods

• downloadContent(url, sha256) — Low-level fetch + SHA-256 verification. Returns a verified Buffer. Shared by both bundle and skill downloads.
• downloadBundle(name, version?, platform?) — Downloads an MCP bundle by name. Defaults to latest version and auto-detected platform. Returns { bundleRaw, bundleMetadata }.
• downloadSkillBundle(name, version?) — Downloads a skill bundle by name. Defaults to latest version. Returns { skillRaw, skillMetadata }. Internally uses getSkillVersionDownload with 'latest' to mirror how downloadBundle uses getBundleDownload.

Smoke tests

Added integration smoke tests for downloadBundle and downloadSkillBundle that hit the real registry.mpak.dev API:

• downloadBundle — downloads @nimblebraininc/echo, verifies buffer, metadata, SHA-256, and size
• downloadSkillBundle — downloads @nimblebraininc/ipinfo, verifies buffer, metadata, SHA-256, and size

Dead code commented out (with TODO markers)

The removed code (resolveSkillRef, extractSkillFromZip, GitHub/URL resolvers, etc.) was built around two assumptions we've moved away from:

1. Bundles/skills could come from multiple sources (registry, GitHub, direct URL) — We only want to download from our registry. The SDK doesn't need to resolve from GitHub or arbitrary URLs.
2. The SDK should peek inside bundle content (extract SKILL.md from ZIPs) — The SDK's job is to download and verify integrity, not inspect contents. What to do with the bytes (extract, write to disk, etc.) is the caller's decision.

Commented-out methods:

• downloadSkillContent, resolveSkillRef, resolveMpakSkill, resolveGithubSkill, resolveUrlSkill, extractSkillFromZip, verifyIntegrityOrThrow, extractHash

Commented-out types:

• SkillReference, MpakSkillReference, GithubSkillReference, UrlSkillReference, ResolvedSkill

The jszip dependency is no longer used at runtime.

Follow-up items

• Merge getSkillDownload and getSkillVersionDownload into a single method mirroring getBundleDownload (blocked by CLI usage)
• Update README.md with new method documentation
• Delete commented-out code once approved
• TODO: Add smoke tests (test:integration) to CI/CD pipeline

Test plan

• All new methods have unit tests (happy path, integrity errors, 404 propagation, default values)
• Smoke tests added for downloadBundle and downloadSkillBundle against live registry
• pnpm typecheck passes across full monorepo (CLI still compiles)
• pnpm test passes across full monorepo (51 SDK, 105 CLI, 65 registry, 64 schemas, 61 web)
• SDK build size reduced from 16.83KB to 12.34KB (ESM)

🤖 Generated with Claude Code

[mgoldsborough]

Clean up all the old code/comments etc - it's a relatively small PR but the diff is super messy with more than half the lines just comments.

[mgoldsborough]

I'd also recommend switching Buffer to Uint8Array.

Three things to change:

1. Buffer.from(await response.arrayBuffer()) → new Uint8Array(await response.arrayBuffer()) — standard JS equivalent
2. Return types on downloadContent, downloadBundle, downloadSkillBundle — Buffer → Uint8Array
3. computeSha256 signature — string | Buffer → string | Uint8Array. Node's createHash().update() already accepts Uint8Array, so the implementation doesn't change.

Plus test updates.

[shwetank-dev]

@mgoldsborough if you can clear this one, then it we can dogfood this in the CLI.