fix(core): preserve npm lock when plugin SDK resolves locally

[LeXwDeX]

Closes #541

Why

TUI dependency initialization deleted a valid config package-lock.json whenever the plugin SDK was satisfied by an existing local or bundled copy. The following dirty check then reified the project again, causing lock churn and repeated npm installation on every launch.

What changed

• Preserve the lock when every requested dependency is already satisfied locally or from the bundled SDK.
• Retain lock invalidation for mixed batches that still contain registry dependencies.
• Replace deletion-pinning tests with consecutive-install regressions for local and bundled plugin resolution.
• Pin genuine mixed-dependency and package.json-drift reification behavior.
• Add a two-initialization regression through the real TuiConfig.defaultLayer and waitForDependencies seam.
• Restore all test-owned environment variables after each test.

Evidence

• Core npm focused tests: 8 passed, 20 assertions.
• TUI config startup regression: 1 passed, 3 assertions.
• Core full suite: 1230 passed.
• Core and opencode typechecks passed.
• Root lint passed with 4838 warnings, below the 4850 ratchet.
• Mutation check: restoring the old unlink condition makes both lock-preservation regressions fail.
• DAG verification and review: ACCEPT with no blocking findings; parent additionally hardened environment restoration.

Checklist

• Local plugin resolution preserves lock bytes, inode, and mtime across two installs
• Bundled plugin resolution preserves lock bytes, inode, and mtime across reinstall
• Mixed missing dependencies and package drift still reify
• Two real TUI/config dependency initializations leave the lock stable
• Local > bundled > registry precedence is unchanged