chore(deps): stop duplicating dependency lists across package.json and pantry.json

Evidence

package.json and pantry.json both carry a devDependencies list, and the two have already drifted:

The duplication has already caused one outage. ziglang.org and zig-dtsx are pantry packages — the Zig toolchain is pinned in pantry.json, and zig-dtsx is resolved by build.zig from pantry/zig-dtsx/ with a committed stub fallback (packages/ts_emit/vendor/zig_dtsx_stub.zig) — but both had also been copied into package.json. Neither exists on npm:

$ bun install
error: GET https://registry.npmjs.org/ziglang.org - 404
error: GET https://registry.npmjs.org/zig-dtsx - 404
error: zig-dtsx@^0.9.31 failed to resolve
error: ziglang.org@^0.17.0-dev.1441+d5181a9c9 failed to resolve

So bun install failed outright on a clean checkout, taking every JS/TS dev tool (pickier, tsc, bunpress) with it. Fixed in 7503300 by removing the two pantry-managed entries from package.json; both remain declared in pantry.json, so nothing was unpinned. bun install now exits 0 and installs 146 packages.

That fix addresses the instance, not the cause: nothing stops the next pantry-managed package from being copied into package.json, and nothing reconciles the bunpress version skew above.

Proposal

Pick one owner per dependency class and make drift detectable:

• Decide whether pantry.json devDependencies is authoritative for npm packages or whether it should only carry pantry-managed ones (ziglang.org, zig-dtsx). Today it carries both kinds, which is what invites copying.
• Reconcile the @stacksjs/bunpress skew in whichever file stays authoritative.
• Add a check that fails when a manifest declares a package the corresponding registry cannot resolve, so a 404 pin is caught in CI rather than on a contributor's first bun install.

Acceptance

• One authoritative list per dependency class, with the bunpress skew resolved.
• A clean-checkout bun install is exercised in CI and fails the build when it does not exit 0.
• A pantry-managed package added to package.json (or vice versa) is rejected automatically.

Completed directly on main in 0ae8024. package.json and bun.lock now exclusively own Bun/npm tooling; pantry.json keeps only the Pantry-only zig-dtsx development pin plus the Zig system dependency; the stale npm-sourced React entry was removed from pantry.lock. A new offline policy check rejects cross-owned packages, stale Bun root-lock entries, version drift, and npm-sourced Pantry lock entries. CI now runs that check and performs an uncached bun install --frozen-lockfile. Verification: current manifests pass; adversarial duplicate-owner, npm-in-Pantry-lock, and Bun-lock-drift fixtures all fail with the intended diagnostics; Pickier passes; and an isolated clean frozen install installed 73 packages successfully at a guarded 16 MB peak. Exactly five files changed, direct to origin/main, no PR.