remove a dangling export, and write down the lockfile question

`pluginPackageJsonExists` was exported for an uninstall hook that was never
wired. an export with no caller is an unfinished thought pretending to be a
feature, so it is gone — and the behaviour it would have served is right
anyway: uninstall KEEPS the plugin directory, so its packages are still
declared and still wanted. only "delete and all its data" removes the
directory, after which the next install regenerates the merged file without it.
the packages linger until then and go on their own.

and the thing the owner asked to come back to: CLAUDE.md's frozen-lockfile rule
reads as universal, and npmDependencies does not follow it. ranges resolving
per machine is what lets two plugins share one sharp, and it was chosen
knowingly — but the codebase now holds two postures on one risk with only one
of them written down. recorded in TODO.md with the three specific things worth
settling rather than left as a feeling that something is inconsistent.

src/servers/plugins/npm-deps.ts

@@ -1,4 +1,3 @@
-import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { PLATFORM_DIR } from '../data-path';
 import type { DiscoveredPlugin } from './manifest';
@@ -149,5 +148,14 @@ export function unresolvableDependencies(plugin: DiscoveredPlugin): string[] {
 export const anyPluginWantsPackages = (plugins: DiscoveredPlugin[]): boolean =>
   plugins.some((p) => Object.keys(p.manifest.npmDependencies ?? {}).length > 0);
 
-/** For the uninstall path: the generated file exists and can be regenerated without the removed plugin. */
-export const pluginPackageJsonExists = (): boolean => existsSync(PLUGIN_PACKAGE_JSON);
+// ── Uninstall deliberately does NOT shrink this ──
+//
+// There was an exported `pluginPackageJsonExists` here, written for an uninstall hook that was never
+// wired. Removed rather than left dangling — an export with no caller is an unfinished thought pretending
+// to be a feature.
+//
+// The behaviour it would have served is right anyway, for a reason worth stating. Uninstall keeps the
+// plugin's DIRECTORY (see the runbook), so `discoverPlugins` still finds it and its packages are still
+// declared. Only "Delete … and all its data" removes the directory, and after that the next install of
+// any plugin regenerates the merged file without it. So the packages linger until the next install and
+// then go, with nothing needing to remember them.