fix(sdk): task 9 review round 1 — dispatch test, typesDir:null, unreviewed wording

Review findings on the library-vendoring add() dispatch:

- No test exercised addPackage's success path for either kind, so a drift between
  where `s2s add` vendors a library and where localLibraryDir/resolveLibraries expect
  it would surface as a late, confusing build failure rather than a red test here.
  addPackage now threads an optional `fetch` through to RegistryClient (mirroring its
  existing RegistryClientOpts.fetch), so the new test/add-dispatch.test.mjs can use the
  established fetch-stub pattern instead of a globalThis.fetch monkey-patch. It asserts
  the on-disk layout, the s2script.libraries merge, that no .npmrc is written, and —
  the actual seam — that addPackage's libDir matches localLibraryDir's independent
  computation and that the real resolveLibraries() resolves straight to it.
- AddedPackage's library variant now types typesDir as `null`, not the vendored libDir:
  both union members declared `typesDir: string`, so the discriminated union forced no
  narrowing at all. libDir/npmrcLine already differ by type across variants; typesDir
  now does too.
- commands/add.ts's interactive "unreviewed" warning said "types pulled" unconditionally,
  even for a library — the non-interactive branch already said "library pulled" there.