fix(plpgsql-deparser): move libpg-query to dependencies

[pyramation]

Summary

plpgsql-deparser ships a runtime import of libpg-query but declares it as a devDependency, so the published package has an undeclared dependency:

// src/hydrate.ts:2 — in the published tree
import { parseSync, scanSync } from 'libpg-query';

-  "devDependencies": { "libpg-query": "18.1.4", "makage": "^0.5.1" },
-  "dependencies": { "@pgsql/types": "^18.0.0", "pgsql-deparser": "workspace:*" }
+  "devDependencies": { "makage": "^0.5.1" },
+  "dependencies": { "@pgsql/types": "^18.0.0", "libpg-query": "18.1.4", "pgsql-deparser": "workspace:*" }

It has been loading by accident: plpgsql-parser (and pgsql-parser, pgsql-parse, @pgsql/lint, plpgsql-parse — every sibling that imports it) does declare libpg-query: 18.1.4, so a hoisted copy is usually reachable from plpgsql-deparser's own directory. In any tree where it isn't — pnpm without the hidden hoist, a pruned install — require('libpg-query') throws at import time and takes the whole chain down with it, since nothing above can be loaded either:

Error: Cannot find module 'libpg-query'
Require stack:
- .../plpgsql-deparser@18.2.7/node_modules/plpgsql-deparser/hydrate.js
- ... plpgsql-parser → @pgsql/semantics → @pgpmjs/transform → @pgpmjs/slice → @pgpmjs/core → pgpm

That is how it surfaced: pgpm is unusable in an affected install (it broke a lerna publish in constructive-platform, whose version lifecycle runs pgpm sync-versions). plpgsql-deparser was the only package in this repo importing libpg-query from src/ without declaring it — verified across all packages.

Pinned to 18.1.4, exactly matching every sibling, so no consumer gains a second copy.

Verified: pnpm install --frozen-lockfile accepts the hand-minimized lockfile edit (the dependency graph is unchanged, the edge just moves importer sections), the built dist/package.json — the manifest actually published — now carries libpg-query under dependencies, and plpgsql-deparser tests pass (115 tests, 79 snapshots, 252/252 round-trip fixtures).

Release note: dependents pin plpgsql-deparser exactly (plpgsql-parser@18.5.7 → plpgsql-deparser@18.2.7), so consumers only pick this up once lerna's conventional-commit cascade republishes plpgsql-parser and friends along with the fix: patch here.

Link to Devin session: https://app.devin.ai/sessions/d1f8e59e2aeb44bcb6dbeb0edd1145c6
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring