fix(cli): declare release and DOM test dependencies

[c8dhjp4tyv-bit]

Recreated on the rewritten main after #1109 was auto-closed during repository maintenance. The dependency declarations were ported onto the rewritten snapshot and bun.lock was regenerated with the current repository Bun version instead of copying the pre-rewrite lockfile.

Summary

• declare tar, which the release launcher and wrapper safety tests import in the private CLI workspace
• declare @types/react-dom, which the CLI's server-rendering tests require for typechecking
• update bun.lock with the minimal dependency graph changes while preserving the rewritten upstream lockfile

tar intentionally remains a CLI workspace devDependency: the actual published wrappers (cli/release, cli/release-staging, and freebuff/cli/release) each already declare tar in their own runtime dependencies.

Validation

Prior validation before the history rewrite:

• CLI typecheck passes with exit code 0
• release wrapper repair test passes
• DOM-rendering component tests pass
• runtime smoke import confirms tar.c and renderToStaticMarkup resolve
• verified the tar 7 lockfile graph keeps incompatible older consumers nested (tar-fs/chownr@1.1.4, lru-cache/yallist@4.0.0) rather than upgrading them transitively
• git diff --check passes

For this recreated branch, Bun 1.3.14 regenerated the lockfile from the current rewritten main. The resulting diff remains exactly 2 files with the same 18+/2- lockfile and 3+/1- package-manifest scope as the final old branch.