A test fails when the forge gains a runtime dependency or bun.lock is out of step with package.json

docs/THREATS.md (A compromised vendor) says the forge has no runtime dependencies and "Nothing checks that this stays true".

Done looks like:

[ ] A test reads package.json and fails, naming the package, when dependencies (or optional/peer dependencies) is non-empty.
[ ] The same test fails when a devDependency in package.json is missing from bun.lock or bun.lock names one package.json does not.
[ ] The THREATS.md bullet's Test: none yet names the new file, and test/threats-doc.test.ts still passes.

Files: test/deps.test.ts (new), docs/THREATS.md. Risk: parse bun.lock as text/JSONC without adding a parser dependency.

A test fails when the forge gains a runtime dependency or bun.lock is out of step with package.json #3026