fix(package): use host-provided TypeBox peer

[danielgap]

What and why

Closes #21.

• Move typebox from runtime dependencies to a required wildcard peer, so Pi supplies its host module instead of installing an extension-local copy.
• Keep the existing TypeBox range in development dependencies. The peer remains required because the standalone public library imports TypeBox; ordinary npm installs resolve it automatically.
• Add three offline package-contract regressions, update the lockfile and dependency documentation, and teach the package smoke test to distinguish optional Pi peers from the required library peer.

Verification

• npm ci and npm run check pass. Baseline: 134/134 tests; candidate: 137/137, no failures or skips. Build and typecheck pass.
• Changed behavior has offline tests. All three new contract tests fail against the original manifest/lockfile and pass after the fix.
• Documentation and changelog notes are updated where needed.

Additional checks:

• Executed the workflow's package metadata check, isolated tarball/library smoke test without optional Pi peers, and entry-point smoke test with locked peers: all pass.
• Real isolated Pi 0.99.1 RPC startup using the tarball installed with --omit=peer: no physical TypeBox in the consumer, successful get_state, and typesafe command registered. No host-dependency warning or extension error. No active Pi installation was modified.
• actionlint 1.7.12 passes with ShellCheck disabled locally (ShellCheck is not installed); full workflow lint remains for CI.
• git diff --check passes. Scope: 7 files, 49 additions + 10 deletions (59 changed lines).

Live testing is not applicable: no transport or response-validation behavior changes and no billable requests were sent.

Compatibility and release notes

No public API or package version change. typebox is intentionally not an optional peer: consumers outside Pi still need it. Package managers that do not automatically install peers must install typebox alongside pi-typesafe, as documented in the README.

Existing Pi peer ranges are unchanged. Other host versions, Node versions and macOS were not locally tested; the existing CI matrix covers the supported Node/platform combinations. Baseline and candidate npm installs both report one pre-existing high-severity transitive brace-expansion advisory; dependency security upgrades are outside this focused fix.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.