fix(deps): fail fast on stale runtime dependencies

[rochecompaan]

Summary

The missing workflowChildren metadata came from a run that started before Home Manager activated Patchmill 0.20.0. That running Pi process had already loaded an older Patchmill build with pi-subagents 0.55.0. Home Manager activation changes what new processes load; it does not replace modules in an existing process.

This change hardens source execution against a separate drift case: package.json can advance while the untracked node_modules tree still reflects an earlier install.

• run npm ls --depth=0 before npm test
• verify resolved pi-subagents matches Patchmill's exact pin before source CLI dispatch
• fail with an actionable npm install or packaged-install message
• limit the bootstrap catch to dependency preflight so normal CLI errors are unchanged

No npm install ban is introduced.

Tests

• npm test — 1414/1414 passed
• focused dependency and CLI tests — 5/5 passed
• Prettier and ESLint — passed
• nix build path:.#patchmill --no-link --print-build-logs — passed
• built dist/bin/patchmill.js version — passed
• stale source-dependency simulation — preflight and npm ls both fail before CLI dispatch

Known baseline failures

• npm run check:types has unrelated existing failures; none reference changed files
• npm run check:architecture has an existing extensions/todos.ts → typebox violation