Deliver unmanagedDeps through package.json, not positional install args

[arcaputo3]

Onto the #13 branch (the collapsed stack), targeting agent/idiomatic-scalajs-mill-workflows.

The bug

unmanagedDeps was unconditionally broken under a lockfile — in every module type. Local paths
were passed as positional arguments to bun install, which turns the invocation into
bun add, and bun add is always rejected by --frozen-lockfile. Without a lockfile it
"worked", but a lock produced by bunLock recorded the absolute checkout path, so the lock
was unusable on any other machine. No fixture, example, or README section ever exercised the
feature, which is how this survived.

The fix

Local packages now travel through the generated package.json, like every other dependency:

• Each entry is staged into vendor/ beside the generated package.json and declared as
  file:./vendor/<name> (name read from the package's own package.json; scoped names map to
  one path segment, @scope/pkg → scope+pkg, matching the workspace layout convention).
• The lock records file:vendor/<name> — validated against real Bun 1.4.0: the lockfile
  survives relocating the repository, and frozen installs resolve the package.
• The staged copy excludes the package's own node_modules; bun resolves the package's declared
  dependencies through the lockfile instead.

Applied uniformly across all six install/lock sites: Scala.js (bunInstall/bunLock),
TypeScript (npmInstall/bunLock), the TypeScript test trait (union of outer and test-side
unmanaged deps — the bare-module reuse equality from #20 is preserved), the publish module's
vendored-runtime install, and Bun workspaces, where vendor trees are staged in the layout beside
each member's package.json so member-relative file:./vendor/… specifiers resolve in both
standalone and workspace installs.

Guard rails: a name declared both as an npm dependency and an unmanaged directory is rejected
(one resolution source per package), as are two unmanaged directories claiming the same name.
Tarballs are rejected with guidance to unpack them. Published manifests are unaffected — they
are built from the npm dependency lists, so file: specifiers cannot leak to consumers.

Tests — first-ever coverage for this feature

• typescript-unmanaged fixture (new, real Bun, bunRequireLockfile = true): bunLock
  records file:vendor/local-lib and no absolute path; a frozen npmInstall materializes the
  package; the bundle runs and prints from the local package. Fails on the parent commit
  (the lock never contains file:vendor/local-lib).
• mixed-workspace: the Scala.js member declares an unmanaged dep; the test asserts the
  member manifest carries the file: specifier, the vendor tree is staged in the install, and
  no positional args reach the (recorded) install invocation. Fails on the parent commit.
• Unit tests for name extraction (incl. scoped), the missing-package.json and name-collision
  errors, and node_modules exclusion during staging.

Full suites green: unit and integration, exit 0.