fix(ingestion): vendor graphty Leiden to drop node-pty install fetch (#157)

## Summary

`@opencodehub/ingestion` → `@graphty/algorithms@1.7.1` → `pupt` →
`@homebridge/node-pty-prebuilt-multiarch`, whose `install` script runs
`prebuild-install` (a `github.com/.../releases` fetch). That tripped
**Verify Global Install gate 2** (no GHCR/postinstall fetches) on the
macOS legs, and dragged node-pty's `prebuild-install`/`glob` deprecation
warnings into `npm install -g @opencodehub/cli`.

This is the gate-2 failure that's been keeping macOS red even after the
nvm fix (#152).

## Why vendoring (and not an override)

- `@graphty/algorithms` is genuinely used — `communities.ts` runs Leiden
community detection. Can't drop it outright.
- But its compiled `dist` has **zero references to `pupt`** — `pupt` is
an interactive CLI tool sitting unused in graphty's dependency list,
dragging in node-pty.
- **npm `overrides` in a published package are honored only when it's
the install ROOT.** Under `npm install -g <tarball>` the tarball is a
*dependency* of npm's synthetic root, so its overrides are ignored
(verified empirically). The only lever that works at the published
boundary is removing `@graphty/algorithms` from the tree.

graphty is MIT (© 2024 Adam Powers). Vendored its Leiden closure
(`Graph`, `graphToMap`, `SeededRandom`, `leiden`) into
`src/pipeline/phases/vendor/graphty-leiden.ts` with the full license
header.

## Changes
- New `vendor/graphty-leiden.ts` (faithful TS port, MIT header)
- `communities.ts`: import swapped to the vendored module (call sites
unchanged)
- Removed `@graphty/algorithms` from ingestion deps; deleted dead
`graphty.d.ts`
- Removed the now-dead `@homebridge/node-pty-prebuilt-multiarch`
`allowBuilds` entry in `pnpm-workspace.yaml`
- Lockfile prunes the graphty → pupt → node-pty subtree (~114 packages)

## Verification
- **Determinism preserved (proven):** parity harness compared the
vendored module vs upstream `@graphty/algorithms@1.7.1` across
**1750/1750 cases** (25 graph seeds × 14 shapes × 5 leiden seeds) —
identical community assignments, modularity, iteration count.
- **Gate 2 passes:** `npm install -g` of all 17 publishable tarballs →
zero `github.com/.../releases` / `prebuild-install` lines (was a hard
fail before).
- ingestion **602/602**; full recursive pre-push gate (test + typecheck
+ verdict) green.
- Rebased cleanly over #155 (write-file-atomic): lockfile carries both
changes coherently — wfa@7.0.1 present, graphty/pupt/node-pty fully
gone.

## Follow-up (not in this PR)
Worth filing upstream: graphty declares `pupt` as a hard `dependency`
though its runtime never imports it — should be a devDependency. That
would fix this for all graphty consumers.

## Test plan
- [x] 1750/1750 Leiden parity vs upstream
- [x] Gate 2 clean on global install
- [x] ingestion 602/602, recursive suite green

Author: theagenticguy

packages/ingestion/package.json

@@ -42,7 +42,6 @@
     "@apidevtools/swagger-parser": "12.1.0",
     "@aws-sdk/client-bedrock-runtime": "3.1054.0",
     "@cyclonedx/cyclonedx-library": "10.0.0",
-    "@graphty/algorithms": "1.7.1",
     "@iarna/toml": "2.2.5",
     "@opencodehub/analysis": "workspace:*",
     "@opencodehub/core-types": "workspace:*",

packages/ingestion/src/pipeline/phases/communities.ts

@@ -23,14 +23,14 @@
  * `community-<id>` is used when no tokens survive.
  */
 
-import { Graph as GraphtyGraph, leiden } from "@graphty/algorithms";
 import type { CommunityNode, NodeId } from "@opencodehub/core-types";
 import { makeNodeId } from "@opencodehub/core-types";
 import type { PipelineContext, PipelinePhase } from "../types.js";
 import { resolveIncrementalView } from "./incremental-helper.js";
 import { INCREMENTAL_SCOPE_PHASE_NAME } from "./incremental-scope.js";
 import { MRO_PHASE_NAME } from "./mro.js";
 import { STRUCTURE_PHASE_NAME } from "./structure.js";
+import { Graph as GraphtyGraph, leiden } from "./vendor/graphty-leiden.js";
 
 export const COMMUNITIES_PHASE_NAME = "communities";