fix: expose callXrpc bridge on globalThis in production
SvelteKit SSR load functions call callXrpc via globalThis.__hatk_callXrpc,
but main.ts never set it. Now exposes callXrpc, parseSessionCookie, and
sessionCookieName before loading the SvelteKit handler.
Bumps to 0.0.1-alpha.28.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>