chore(deps): refresh runtime pins and trim publish assets

[code-yeongyu]

Status: blocked, not ready for merge

Commit 2c5e6ae49 has green required CI. Final package QA found an additional unhoisted-sourcemap case. Its focused follow-up is implemented but remains uncommitted because the remote execution service became unavailable during verification. Consumer QA and remote cleanup are incomplete.

What and why

• Refresh the requested exact provider, schema, parser and tooling pins; preserve held major versions.
• Remove unused declarations and native image-fixture tooling while retaining npm-compatible development scripts.
• Synchronize both install-script allowlists and all generated locks, including platform packages.
• Exclude build-only sourcemaps from root, bundled and vendor publish output; retain declarations and documentation assets.

Verified evidence

• Initial RED: isolated package/image regressions and publish-copy regression.
• Initial GREEN: 19 focused tests, runtime-dependency validation, full static checks, workspace build, browser smoke, and isolated npm/Bun/pnpm install-and-build verification.
• Remote AI suite: 2,866 tests passed; existing optional/live tests remained gated.
• Three real npm development compilation/termination cycles passed.
• Standalone macOS compilation and relocated-binary smoke passed.
• Required CI passed, including all three coding-agent shards, Linux workspace/script tests, Windows RPC, cross-OS terminal/worker tests, and changelog/review gates.

Remaining verification and findings

• Publish-staged base: 157,518,393 unpacked bytes and 6,109 maps.
• First candidate: 107,259,373 unpacked bytes, but 44 maps remain in unhoisted dependency directories. The zero-map gate correctly failed despite the size improvement.
• The final-staging follow-up passed 15 focused tests; its final pack and consumer smoke are not verified or included in this PR yet.
• The unchanged workspace-signal test fails remotely because its directory watcher misses an existing marker file; all three isolated controls reproduced it. Its Linux CI run passes. No assertion or deadline was changed.
• The long remote coding-agent invocation lost its response during an execution-service restart. Final suite collection, outdated audit, and cleanup are blocked by subsequent bridge_disabled errors. No local-test or SSH fallback was used.
• Two package-specific release-age exceptions are dated for removal after 2026-09-15; the general age policy remains enabled.

Refs #1656.

Plan: .omo/plans/omo-dependency-diet.md