Publish post-check fails after a good publish: it reads deps from the wrong path #102

Problem
The Publish run on 3fa3e12 (the #93 merge) published @gabe4coding/plain@3.1.0 to npm at 14:37 CEST, but the job then failed in "Check the published package". The shrinkwrap check reads $prefix/node_modules/<dep>/package.json, but the shrinkwrap installs deps nested under $prefix/node_modules/@gabe4coding/plain/node_modules/. It hit ENOENT on @modelcontextprotocol/sdk. The package itself installs fine, and the CLI runs on Node 22.

Proposed change
Read installed versions from the nested path (fall back to the hoisted path), and compare against the lockfile. Add a test for both layouts.

How to verify
Re-run the check step against 3.1.0 from npm and confirm it passes. This touches CI, so it goes to Gabe.