fix(006): resolve chassis pins per package, not in lockstep

[bartekus]

Summary

The chassis packages moved from the retired @enrahitu scope to @statecrafting and are now versioned independently: @statecrafting/toolchain is published at 0.1.0/0.2.0/0.3.0 while @statecrafting/hiqlite-native and @statecrafting/kernel-native remain at 0.1.0. Spec 006's original model resolved one target and pinned it to every chassis package, which would have pinned the companions to a version they never published (and failed the lockfile refresh).

This replaces that with per-package resolution:

• A seed (a package the contract names in [requires]) resolves the greatest published version its named range allows.
• A companion (in the chassis scope but unnamed) resolves within a caret of its current pin, so it never crosses its own major silently and is never pinned to a nonexistent version.
• --to overrides the primary seed only; every other package auto-resolves. The compat gate applies to the forced primary target.
• The runner accepts both npm view --json shapes (array, and the bare single-version string some npm builds return).

Per the coherence guard, spec 006 was amended first (per-package model in §2; as-built record and live check in §5), then the code. implementation flips to complete.

Testing

• cargo fmt --check, cargo clippy --all-targets -- -D warnings, cargo test (106 unit + 16 CLI, green).
• spec-spine compile | lint --fail-on-warn | index check green.
• New/updated tests cover per-package targets, a companion bumped independently of the forced primary, and the regression itself (a companion that never published the seed's target stays put).
• Live check against the real npm registry: a stamped-app fixture consuming the real @statecrafting/* packages upgraded toolchain 0.1.0 -> 0.3.0 with both companions held at 0.1.0 (real npm install --package-lock-only resolved all three), verify green, committed on template-upgrade/0.1.0-0.3.0, exit 0; the mirror ^0.1 + --to 0.3.0 case refused with incompatible_target, exit 1.

Spec-Drift-Waiver: src/verbs/template.rs couples to spec 002's Cargo crate territory, which owns all of src/**, so any source edit drifts against 002 without an authoring edit to it. This change's design-owning spec is 006 (it establishes the statecraft_cli::verbs::template symbol and was amended here); the 002 coupling is the standing mechanical crate-territory drift, not a design contradiction. A coupling waiver, not a coherence override.