Remove read-pkg and write-package dependencies

[bcomnes]

Summary

• Replace write-package with a small local dependency updater used by --eject.
• Remove the companion read-pkg dependency and reuse the CLI's existing JSON reader for the package type and dependency versions.
• Preserve unrelated package fields, existing dependencies, indentation, trailing-newline style, and support for BOM-prefixed package JSON.
• Remove the write-package and deepmerge-ts production dependency chain.

read-pkg provides normalized metadata and enhanced JSON errors, but these eject lookups do not need metadata normalization.
No new reader abstraction or replacement dependency is introduced.

Validation

• npm test passes, including lint, Node tests, Playwright, installed-check, and TypeScript.
• CLI smoke checks cover ESM and CommonJS eject filenames, all three dependency versions, unrelated metadata, BOM-prefixed input, --version, and --help.
• The smoke checks also pass against a clean installation of the packed runtime package.
• The clean production installation contains no read-pkg, write-package, or deepmerge-ts entries.
• npm audit --omit=dev reports zero vulnerabilities for that installation.

Fixes #293.

[coveralls]

Coverage Report for CI Build 34012808916

Coverage increased (+0.3%) to 94.52%

Details

• Coverage increased (+0.3%) from the base build.
• Patch coverage: 24 of 24 lines across 1 file are fully covered (100%).
• 2 coverage regressions across 1 file.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

2 previously-covered lines in 1 file lost coverage.

File	Lines Losing Coverage	Coverage
lib/build-copy/index.js	2	94.44%

---

Coverage Stats

Relevant Lines:	7330
Covered Lines:	7102
Line Coverage:	96.89%
Relevant Branches:	1594
Covered Branches:	1333
Branch Coverage:	83.63%
Branches in Coverage %:	Yes
Coverage Strength:	179.46 hits per line

---

💛 - Coveralls

[bcomnes]

Need to see if the vendored versions behave the same or if we need to port more features over.