fix(sdk): detect workspace-linked deps by realpath, not a fixed node_modules depth

isWorkspaceLinked only checked pluginDir/node_modules/<dep>, the shape npm
produces only when the plugin's own package.json is the workspace root.
Every real plugin/example in this repo is nested UNDER a workspace root
instead, so npm hoists a sibling's symlink to the root's node_modules and
the plugin gets no node_modules of its own - a false-positive registry
refusal on exactly the topology this repo uses everywhere.

Walk ancestor node_modules directories to find the entry (as Node's own
resolution does), then classify by realpath: a workspace symlink resolves
to real source outside any node_modules segment; a genuine registry
install (npm's own copy, or pnpm's node_modules/.pnpm store) never does.
Robust to hoisting depth instead of one fixed directory.

Verified against two real `npm install --offline` probes and added a test
that builds its fixture via a real npm install rather than hand-placed
symlinks, so a future hoisting change is caught here instead of trusted
from memory. Also drops a dead dep === "@s2script/sdk" check already
subsumed by the adjacent startsWith("@s2script/").