feat: distribute the registry as a runnable npm dependency

[lmcorbalan]

Summary

Part of #157

canton-dappbooster needs to run this registry in its local stack with the pin in a
lockfile, the way it already consumes @bootnodedev/canton-wallet-service. Today
nothing here is packable, and a root npm install vendors 124 MB of Splice for a
service that never reads a DAR. This makes the root manifest the npm face of the
repository and ships the six task branches of the epic (#164, #165, #166, #167, #168,
#170).

Changes

• Root manifest becomes the package: @bootnodedev/canton-token-forge 0.2.0,
  "type": "module", bin, files, engines >=20, and the service's four runtime
  dependencies
• postinstall deleted, prepare compiles registry/src; vendoring the Splice DARs
  is now the explicit npm run setup
• The build-output ignore rule moves to the root .gitignore as registry/**/dist,
  so registry/dist reaches the tarball
• scripts/check-registry-deps.mjs + npm run check:deps: fails when the two
  manifests or their lockfiles disagree on a declared package
• scripts/registry-install-smoke.sh + npm run smoke:registry: packs, installs into
  a scratch consumer and runs the bin, with no participant and no Daml toolchain
• A package CI job running both, plus an ungated table asserting where the
  build-output ignore rule lives and what it covers
• README.md documents the consumer install; RUNBOOK.md, ARCHITECTURE.md,
  CLAUDE.md and SPEC.md refreshed

Acceptance criteria

• A consumer pins this repository in dependencies and gets a working install
  with neither dpm nor a JDK on PATH
• pnpm exec canton-token-forge-registry starts the service, configured entirely
  from the environment. Diverged: npm links and runs the bin unmodified, but
  pnpm 10 and 11 refuse a git dependency that builds on install unless the
  consumer allowlists the resolved specifier. Documented in README.md and
  tracked as Reconsider building the registry on install, which pnpm consumers must allowlist #169
• The install needs no Daml dependency fetch, and nothing prebuilt is committed
• A single command proves the published package installs and serves, and CI runs
  it on every change that could break it
• The root and registry/ dependency lists cannot drift without failing a check.
  Scoped: the guard compares the packages declared in both manifests plus
  their lockfile resolutions; the full runtime closure was considered and declined
• The README documents the consumer install, the run, the required environment,
  and the git-credentials precondition
• Every document that describes the install lifecycle matches what it now does
• v0.2.0 is cut after merge and the pin the README names resolves

Test plan

Automated tests

The two new scripts are the tests. npm run check:deps compares 7 shared packages and
exits 0; npm run smoke:registry packs the 24-entry tarball, asserts registry/dist/index.js
and the four OpenAPI specs are in it, installs it into a scratch consumer and runs the bin
twice (unconfigured, then serving /healthz and /registry/metadata/v1/info against a
closed port). Both run in the new package job. The registry's own 205-test suite is
unchanged and green. All three checks were green on 427969c; CI runs only on pull
requests and pushes to main, so this PR is the first run over the merged tree.

Manual verification

A real npm install github:BootNodeDev/canton-token-forge#<sha> from a scratch consumer
outside the repository lands the 24-entry payload and runs the bin. Each of the six task
PRs carried its own review round before merging here.

Breaking changes

A root npm install no longer vendors the Splice DARs; that is npm run setup now. The
root package also gains a scoped name, "type": "module" and a Node >=20 floor. Nothing
outside this repository consumes it yet.

Checklist

• Self-reviewed my own diff
• Tests added or updated
• Docs updated (if applicable)
• No unrelated changes bundled in

Screenshots

None.