chore(deps): regenerate lockfile after A1 file: → bare-workspace rewrite

Lockfile reflects bare semver "*" workspace references for the 11
@calmstudio/* and @finos/calm-models entries rewritten in A1. All 6
@calmstudio/* workspace symlinks resolve (calm-core, diagram, extensions,
github-action, mcp, studio) and @finos/calm-models symlink resolves to
the top-level calm-models workspace. All 19 rollup platform-specific
optional dependency variants preserved (matches origin/main shape — npm
validate-lockfile CI workflow guard upheld).

minimatch@10.2.5 is hoisted to root node_modules/ (matches origin/main),
so @vscode/vsce — which depends on minimatch@^10.2.2 with the v10 named-
export shape — works correctly. (Earlier rev a629650 used `npm install --force`
which skipped PlaceDep dedupe and left minimatch@9.0.9 nested under
calm-plugins/vscode/; that broke vsce's CJS require. This rev uses the
incremental method and preserves origin/main's hoist tree.)

Regen method (avoiding the pre-existing arborist crash on a clean
`rm -rf node_modules package-lock.json && npm install`):
  git checkout origin/main -- package-lock.json
  rm -rf node_modules
  npm install --package-lock-only --legacy-peer-deps
  npm ci --legacy-peer-deps

`--legacy-peer-deps` works around the pre-existing peer conflict between
vite@8.x in calm-hub-ui and @vitejs/plugin-react@4.7.0's peer range.

Signed-off-by: Gourav Shah <gjs@opsflow.sh>

Author: gjs-opsflo