fix(lambda): pin external installs from lockfiles

[jperezrealini]

Summary

• resolve direct and transitive Lambda external dependencies from npm, pnpm, Bun, and Yarn lockfiles
• preserve npm aliases and context-specific duplicate resolutions through generated npm overrides
• generate a package lock and install with npm ci for reproducible Linux/architecture-specific bundles
• support clean checkouts with legacy bun.lockb files and validate Bun workspace importers

Why

Lambda external package installation previously pinned only direct dependencies. npm could therefore re-resolve transitive packages, producing bundles that differed from the source lockfile. Some Bun workspace, alias, and binary-lockfile cases could also select the wrong package or depend on an existing node_modules tree.

Impact

External Lambda packages now install reproducibly from the reachable lockfile dependency graph, including native Linux/arm64 packages, aliases, and nested version conflicts.

Validation

• bun run test test/Bundle/InstalledPackages.test.ts --retry 0 (35 tests: 33 passed, 2 gated integrations skipped)
• gated npm-install integration tests for aliases/transitives and sharp arm64 binaries
• real repository Bun lock install probe
• bun tsc -b
• bun oxlint packages/alchemy/src/Bundle/InstalledPackages.ts packages/alchemy/test/Bundle/InstalledPackages.test.ts
• bun oxfmt --write on changed files
• git diff --check