fix(deps): use host-provided optional peer dependencies

[ObsidianArch02]

Summary

Pi reports a startup warning because this extension installs typebox as a runtime dependency. A physical host-module copy can bypass Pi's extension module mapping and create duplicate runtime instances.

• Declare all four Pi SDK packages and typebox as * peers, as required by Pi's package contract. Mark these peers optional so npm does not automatically install a separate host. Keep pinned copies in development dependencies for standalone tests and type checking.
• Regenerate both lockfiles without upgrading resolved packages. Update manual installation to npm install --omit=dev --legacy-peer-deps and correct the Unreleased notes.
• Add packaging regression tests for peer ranges, optional metadata, runtime and bundle exclusion, development dependencies, and npm lockfile consistency.

Closes #58.

The same warning is reported in parallel-npm-packages#64 and wherever#68.

Verification

• bun install --frozen-lockfile --ignore-scripts
• bun run check and bun run test: 104 tests pass.
• npm ci --ignore-scripts --no-audit --no-fund, npm test, and npm run check: 104 tests pass.
• npm pack --dry-run --ignore-scripts: eight package files, no bundled host modules.
• Isolated npm ci --omit=dev --legacy-peer-deps --ignore-scripts and manifest-only npm install --omit=dev --ignore-scripts: each installs only diff, with no Pi or TypeBox copies.
• Real Pi 1.1.0 public SDK loader against an isolated production installation: one extension loads, no errors or warnings, apply_patch registers, and file addition and update both produce the expected contents. No model API call is needed for this check.
• git diff --check

Local environment: macOS, Node 26.9.0, npm 11.19.1, Bun 1.4.2. Development SDK versions remain 1.0.4. No resolved npm package versions, URLs, or integrity values changed, and Bun's package graph is unchanged. CI provides the repository's Node 22 and 24 coverage.

apply_patch impact

• Tool schema, grammar, and runtime source are unchanged.
• Existing workspace path tests pass.
• CHANGELOG updated under [Unreleased].

Wildcard peers let the running Pi host provide its own modules without a competing version constraint. The previously tested 0.87.1 host remains documented. This packaging fix does not claim compatibility with arbitrary future breaking API changes.