[codex] Repair standalone Bazel package graph

[Jesssullivan]

What changed

• added real standalone Bzlmod wiring for Node and pnpm lock translation
• instantiated local npm-backed vite, tsc, and svelte-check binaries in BUILD.bazel instead of pointing at nonexistent workspace labels
• split declaration output into dist-types so Bazel no longer has competing actions writing the same output tree
• aligned package exports and published files with that split declaration surface
• tracked the standalone Bazel lockfile and ignored local Bazel symlink dirs / generated declaration output
• extended release metadata checks to verify the Bazel-managed pnpm version

Why

The standalone repo still carried monorepo-era assumptions. Bazel metadata had started to move over, but the actual package graph was not truthful: //:pkg could not build because the workspace referenced missing tool labels like //:tsc, and declaration generation conflicted with the Vite output tree.

Impact

• bazel build //:pkg //:typecheck //:test now succeeds from the standalone repo
• the published npm artifact now exposes declaration files from a dedicated dist-types tree that matches package metadata
• the repo has an authoritative lockfile for the standalone Bazel dependency graph

Validation

• pnpm run check:release-metadata
• npx --yes @bazel/bazelisk build //:pkg //:typecheck //:test --verbose_failures
• pnpm run build
• pnpm run check
• pnpm run test
• pnpm run check:package
• npm_config_cache=/tmp/tinyvectors-npm-cache npm pack --dry-run

Notes

• stacked on top of [codex] Harden tinyvectors package metadata #12 (jess/tin-166-add-metadata-parity-readme-and-license-truth-to-tinyvectors)
• this is the Bazel/package-graph repair slice for TIN-167