feat: guard the root and registry manifests against dependency drift

[lmcorbalan]

Summary

Closes #160

The root manifest now ships the registry as an npm package, so the same seven packages are named in two files with nothing keeping them in step. npm run check:deps fails when they come apart.

Changes

• scripts/check-registry-deps.mjs: a runtime dependency declared on one side only, a shared package at two ranges, a mismatched engines.node or type, and a package the two lockfiles resolve differently.
• It also fails when a lockfile stops recording the manifest beside it, the state npm ci refuses and that a range edit leaves behind.
• One check:deps entry in the root package.json.

Acceptance criteria

• All six from the issue are met, plus the two corrections filed as comments on it (resolutions, not just ranges; engines.node and type). Comparison is symmetric, which the issue asked one way.

Test plan

Automated tests

None; the script is its own check and no suite changed.

Manual verification

Twelve mutations redden with the intended message, including a lockfile-only version drift with both manifests agreeing, and a range shadowed by a second declaration of the same package. Green from a fresh clone with nothing installed.

Breaking changes

None.