fix(sdk): task 11 review round 1 — real workspace-library example, reworded refusal

The workspace-refusal error message pointed at examples/monorepo/packages/shared
as "the pattern," but that package uses the older ungated plain-import mechanism,
not s2script.kind: "library" + s2script.libraries — an author following it would
get no typecheck gate, no apiVersion check, and no s2script.libraries resolution
at all. Converting the existing shared package was rejected: it would make
check-workspace-build.sh's built-artifact-count assertion fail (verified: adding
s2script.kind to it makes buildWorkspace produce 3 artifacts against an
`=== ws.plugins.length` (2) check), a real conflict, not a hypothetical one.

Added examples/workspace-library instead: a small dedicated workspace (one
declared library, one consuming plugin) mirroring the exact shape already proven
by packages/sdk/test/fixtures/ws-library, so someone browsing examples/ for "how
do I share a library across a workspace" finds the real, gated mechanism. Verified
build + genuine inlining the same way as the vendored example. Reworded the
refusal message to point at it, and to name the structural reason (outside the
plugins/ glob) rather than only gesturing at an example.

Folded in: cli.ts usage banner now lists --library; README's Examples table gains
rows for workspace-library AND the previously-undocumented engine-call-demo, with
the count corrected to match (Ten, matching the actual directory count).