fix(build): stop running automatic package-manager bootstrap commands on host

[ganesh47]

Motivation

• Prevent untrusted repositories from triggering host-side package-manager installs (pnpm install, uv sync) before Codex runs, which allows arbitrary code execution on the operator's machine.

Description

• Removed generation of automatic bootstrapActions for pnpm and uv in resolveBuildEnvironmentAssessment and replaced them with explanatory notes so the assessment still records detection but does not execute installs.
• Stopped adding pnpm, corepack, and uv to the requiredTools set in this pre-build assessment path to avoid treating those tools as prerequisites for disabled auto-bootstrap behavior.
• Left Maven (mvn) inventory logic unchanged and preserved other tool detection and the toolChecks flow.
• Changes are confined to src/build.ts and only disable/annotate the automatic host-side bootstrap behavior while preserving diagnostics.

Testing

• Ran npm run typecheck and the TypeScript check completed successfully (tsc --noEmit).
• Ran npm test -- test/build.test.ts; unit tests exercised runBuild and completed but report 2 failing tests in this environment: creates a build run with session and verification artifacts and classifies missing host tools during verification (these failures appear related to changed verification expectations after disabling auto-bootstrap).

---

Codex Task