fix(check-coverage): install the extension deps the root sweep needs

[luantaraschi]

Closes #1236.

What breaks

check:coverage spawns root bun test, which sweeps extensions/**/*.test.ts. Those files import packages declared only in each extension's own manifest, so a checkout that has run nothing but bun install fails on resolution instead of on a defect.

$ git clone <repo> warren && cd warren && bun install
$ bun run check:coverage
error: Cannot find module '@sinclair/typebox' from '/work/warren/extensions/judge/src/judge-tools.ts'
error: Cannot find module '@sinclair/typebox' from '/work/warren/extensions/judge/src/report-verdict-tool.ts'
 6859 pass
 7 fail
Ran 6898 tests across 685 files

Thirty-two extension tests never ran.

Scope, narrower than the issue reads

#1226 moved this before I started. lint is the first gate in the manifest and it runs check-extensions.ts, which installs any package declaring typecheck or lint. All six declare typecheck, so bun run check:all on a fresh clone already repairs itself. What is left is the gate standing on its own, and any extension that later ships tests without declaring those two scripts.

The change

I took the shared helper rather than a copy of the step. check-extensions.ts exports ensureInstalled, check-coverage.ts calls it through installExtensionDeps before the sweep, and ExtensionPlan gained hasDependencies so a package declaring nothing is left alone. A frozen install that fails now fails the gate with its own output, instead of letting the sweep die on a module error further down.

ci-parity-config.json said the guard repairs a missing install itself. That held for the lint path only, so the rationale names both consumers now.

Same clean clone, after:

check-coverage: installing extensions/judge dependencies (its tests ride the root sweep)
 6899 pass
 4 fail
Ran 6935 tests across 685 files

6935 against 6898 is the 32 extension tests plus the 5 this PR adds.

Gates

Container clone of 0469c13 on oven/bun:1.3.14. bun run check:all gives 11 of 12 with the patch, and 11 of 12 on clean main in the same container, red on the same gate with the same signature:

✗ check:coverage
  (fail) gke-live overlay apply converges per resource > a resource that fails transiently is retried on its own until it lands
  (fail) gke-live overlay apply converges per resource > a resource that never converges is fatal after the budget, after the rest applied

kubectl is absent there, which is what those two want. I compared the failure sets rather than the counts, and they match exactly.

That revises what I reported on #1186 a few days ago: check:dups and check:deps both pass on main now, so check:coverage is the only gate still red.

What I left out

The issue asks for a clean-clone regression expecting green, and it cannot pass while deploy-trigger.test.ts is red. The preflight is unit-tested against a fake spawn instead. A real clone-and-install case would cost minutes against a suite that finishes in 42 seconds and would want network and disk the rest of the tests do not, so I would rather put it behind an env guard than in the default sweep. Happy to add it if you want it.

check-all.ts and the workflow files are untouched.