test(ci): fail fast when package.json and the lockfile disagree

[PerryLink]

Adds the missing check from the 0.1.6-alpha.2 batch retrospective (R22): two releases in that batch reached CI with a package.json peer that the lockfile did not know about, because the local acceptance chain never ran a frozen install. The first thing that failed was the release workflow, with ERR_PNPM_OUTDATED_LOCKFILE.

What

• scripts/check-lockfile-drift.mjs runs pnpm install --frozen-lockfile --lockfile-only --ignore-scripts: --frozen-lockfile makes pnpm refuse to rewrite the lockfile and --lockfile-only keeps it away from node_modules, so the probe is read-only. Exit 0 = the two files agree; exit 1 prints the one-line fix (pnpm install --lockfile-only, then commit the lockfile).
• package.json gains check:lockfile, and the documented Checks chain in AGENTS.md includes it right after the verify:* gates.

This is the pilot for the family: the same script + one-line wiring can be copied into the other published repos (the batch's ~23 publishers), which is recorded as a rollout item rather than done everywhere at once.

Verified locally

• pnpm run check:lockfile -> lockfile ok: package.json and pnpm-lock.yaml agree (exit 0).
• Negative probe (reversible edit): adding a dependency to package.json without touching the lockfile makes it exit 1 with lockfile drift: package.json and pnpm-lock.yaml disagree. + the fix line; reverted immediately (git status shows only the three intended changes).
• pnpm run typecheck exit 0, pnpm test 133/133.