fix: isolate demo bundle for bookmarklet/script injection

[voidborne-d]

Summary

• wrap the generated page-agent.demo.js output in a final closure so injected bookmarklet usage does not leak helper identifiers like St into the page global scope
• add a small build verification script so future demo bundle builds fail if the output stops being isolated

Testing

• npm run build:demo --workspace=page-agent

Fixes #426

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}