fix: resolve 4 publish blockers — CLI bin, schema export, security vulns, doc link

- Remove leading ./ from bin entry (npm strips invalid paths)
- Write schema to dist/ for export map compatibility (keep assets/ for GitHub URL)
- Remove unused codex dep + bump @modelcontextprotocol/sdk to ^1.25.2
- Fix broken relative link in configuration.md (../guide/installation.md)

🤖 Generated with assistance of OhMyOpenCode (https://github.com/code-yeongyu/oh-my-opencode)

script/build-schema.ts

@@ -2,6 +2,7 @@
 import { createOhMyOpenCodeJsonSchema } from "./build-schema-document"
 
 const SCHEMA_OUTPUT_PATH = "assets/oh-my-opencode.schema.json"
+const DIST_SCHEMA_OUTPUT_PATH = "dist/oh-my-opencode.schema.json"
 
 async function main() {
   console.log("Generating JSON Schema...")
@@ -9,6 +10,7 @@ async function main() {
   const finalSchema = createOhMyOpenCodeJsonSchema()
 
   await Bun.write(SCHEMA_OUTPUT_PATH, JSON.stringify(finalSchema, null, 2))
+  await Bun.write(DIST_SCHEMA_OUTPUT_PATH, JSON.stringify(finalSchema, null, 2))
 
   console.log(`✓ JSON Schema generated: ${SCHEMA_OUTPUT_PATH}`)
 }