chore(deps): regenerate lockfile after A1 file: → bare-workspace rewrite

Lockfile now reflects bare semver "*" workspace references for the 11
@calmstudio/* and @finos/calm-models entries rewritten in A1. All 6
@calmstudio/* workspace symlinks resolve (calm-core, diagram, extensions,
github-action, mcp, studio) and @finos/calm-models symlink resolves to
the top-level calm-models workspace. All 19 rollup platform-specific
optional dependency variants preserved (matches origin/main shape — npm
validate-lockfile CI workflow guard upheld).

Deviation from AGENTS.md Lockfile Regeneration ritual:
The documented `npm install` after `rm -rf node_modules package-lock.json`
crashes inside `arborist.buildIdealTree` with
`TypeError: Cannot read properties of null (reading 'matches')` on both
npm 11.12.1 (via Corepack) and npm 10.9.7 — the same crash reproduces on
plain `origin/main` (no rewrites), confirming this is a pre-existing
arborist dedupe bug, not a regression introduced by A1. Workaround:
`rm -rf node_modules package-lock.json && npm install --force`. `--force`
bypasses the buggy PlaceDep.pruneDedupable path while still enumerating
all 19 optional rollup platform binaries (verified against origin/main
lockfile). Result is bitwise-equivalent to the documented ritual for the
fields validate-lockfile CI checks.

Signed-off-by: Gourav Shah <gjs@opsflow.sh>

Author: gjs-opsflo