2026.10.03 - Fix Pi Host-Provided TypeBox Warning

[lanhhoang]

• Remove typebox from runtime dependencies in package.json and add it as an exact * peer to match the other Pi host-provided modules (@earendil-works/pi-agent-core, @earendil-works/pi-coding-agent).
• Add typebox: ^1.3.19 to devDependencies so local development and type-checking still resolve the import (package.json).
• Regenerate pnpm-lock.yaml with the CI-pinned pnpm 11.24.0 so the root importer moves typebox from dependencies to devDependencies (specifier ^1.3.19, resolved 1.3.19); no unrelated resolutions changed (pnpm-lock.yaml).
• Add tests/package-metadata.test.ts regression that fails if any of the three host-provided packages appears under dependencies, lacks the exact * peer range, or is missing from devDependencies (tests/package-metadata.test.ts).

Verified end-to-end with pnpm check on commit 7470c4c (52 files, 514/514 tests; 57 pre-existing lint warnings; format and typecheck passed) and git diff --check. Confirmed the packed tarball preserves the metadata contract (no dependencies.typebox, peerDependencies.typebox === "*", no nested node_modules/typebox) and that the extension still loads via pi -e "$PWD" with no load error under an isolated config. No source code, README claims, schema, or release workflow were touched.