declare sharp in the manifest, drop the plugin's own package.json

the platform now merges every plugin's `npmDependencies` into one shared
install at plugins/node_modules/, so this declares a RANGE and shares whatever
the next image plugin resolves rather than carrying its own 50 MB copy of
sharp's platform binaries.

replaces the package.json and lockfile added an hour earlier. that version
worked and was the normal thing for a git repository to do; it just did not
survive the question "what happens when a second plugin wants sharp".

manifest.ts

@@ -25,6 +25,17 @@ export const manifest: PluginManifest = {
   icon: 'Palette',
   color: '#f59e0b',
 
+  // `sharp` measures the width, height and alpha channel of a written image (sidecar/generations/
+  // inspect.ts) — load-bearing, not incidental: it is how a `background: transparent` request that
+  // silently produced an opaque image gets caught.
+  //
+  // A range, not a pin. Every plugin's declarations merge into one shared install at
+  // `plugins/node_modules/`, so the next plugin that wants sharp shares this copy rather than adding
+  // another 50 MB of platform binaries. See src/servers/plugins/npm-deps.ts.
+  npmDependencies: {
+    sharp: '^0.33.5',
+  },
+
   permissions: [
     {
       key: 'atelier',