Update @malloydata packages to 0.0.404; fix sync-duckdb drift detection

Bumps all @malloydata/* deps to 0.0.404. That release moved db-duckdb's
DuckDB engine from @duckdb/node-api 1.4.4-r.1 to 1.5.3-r.2, which exposed
a latent bug in scripts/sync-duckdb.ts.

sync-duckdb keeps the CLI's directly-pinned @duckdb packages (node-api,
node-bindings, and the platform-specific native binding packages) in step
with db-duckdb, since the CLI bundles those binaries. It resolved
@duckdb/node-api from the CLI's own node_modules, which is the CLI's pin
itself, so it always compared a version to itself and reported "in sync" --
it never looked at what db-duckdb actually needs. With the versions now
diverged, two copies of node-bindings get installed and esbuild
externalizes the stale platform list, failing the build on the platforms
1.5.3 added (linux-*-musl, win32-arm64).

Fixes:
- Resolve the @duckdb packages from db-duckdb's directory, so we read the
  version db-duckdb depends on rather than the CLI's own copy.
- Rebuild optionalDependencies from node-bindings' own optionalDependencies
  so newly-added platforms are picked up automatically (previously it only
  rewrote versions of platform keys already present).
- Validate before writing, fail with actionable messages, sort output.

Build clean, all 129 tests pass.

Author: mtoy-googly-moogly