fix: take first-party ownership of the npm channel (#213)

The documented Pi install pointed at npm packages the maintainer does not
control: README and .pi docs at @tomxprime/planning-with-files (published
once at 1.1.0 on 2026-05-22, 15 releases behind), docs/pi-agent.md at
pi-planning-with-files (published from a fork at 1.0.1 on 2026-02-04).
Neither can be refreshed from this repo, so the canonical Pi install
handed users a stale snapshot.

Changes:
- .pi/skills/planning-with-files/package.json renamed to the unscoped
  planning-with-files, version 3.9.0, matching the repo release.
- package.json files list gains negation patterns so node_modules,
  __pycache__ and the extension package-lock never enter the tarball
  (a dry-run pack from this machine was 179 MB unpacked without them,
  66 kB with).
- Bundled extension package renamed planning-with-files-pi-extension;
  lock file name and version synced (was stale at 1.1.0 vs 1.2.3).
- All live install docs point at pi install npm:planning-with-files.
- bump-version.py and test_skill_md_version_parity.py add the npm
  package.json to the parity set (19 entries) so the npm version can
  never silently drift from a release again. Publishing stays a manual
  per-release step, documented in AGENTS.md.