deps: runtime dependencies use the latest range and preview-only packages are installed unconditionally #71

Observation on main faf1d88 (package.json)

1. Floating runtime ranges. isomorphic-git and zod are declared as "latest" in dependencies. Consumers installing @deckflow/deckuse from npm do not use this repo's lockfile, so two installs of the same Deckuse version can resolve different major versions of the library that writes workspace history and the library that validates every command.
2. Preview-only packages are hard dependencies. echarts, tailwindcss, @fortawesome/fontawesome-free and playwright-core are referenced only from the render path (src/render.ts, src/render-cache.ts, src/render-pptx-browser.ts). Structural work (init, apply, validate, export) does not need them, and the README already states that export and structural validation work without a browser.

Impact

• Reproducibility: the tool's main promise is deterministic, auditable edits; an unpinned parser/VCS dependency undermines that.
• Cold start: perf: 1.9.7 WorkBuddy 制作 11 页 PPT 耗时 53 分钟的端到端分析与改进建议 #65 recorded 149.7 s for the install call in a fresh managed job. I have not measured how much of that these packages account for.

Acceptance

• No latest ranges in dependencies; use caret ranges on a tested major.
• Measure install time and size with and without the preview packages.
• If the difference is material, move them to optionalDependencies or a separate package, with render --preflight reporting the missing piece as a structured, non-retryable state.