sharp was a direct dependency of the PLATFORM, added during the extraction
because there was nowhere else to put a javascript package. that broke on the
first other machine: alpha pulled the package.json, nobody ran bun install, and
this sidecar crash-looped on "Cannot find package 'sharp'".
the platform now installs a plugin's own packages into the plugin's own
directory (src/servers/plugins/npm-deps.ts), so this ships its own
package.json and lockfile like any other repository — and uninstalling atelier
takes sharp with it instead of leaving it in the platform's lockfile forever.
the lockfile is committed and frozen on install, same discipline the platform
holds itself to. sharp is load-bearing here, not incidental: inspect.ts uses it
to measure alpha channel and opacity, which is how a `background: transparent`
request that silently produced an opaque image gets caught.
