refactor: move the in-process arborist reify off the event loop (durable fix for the first-run freeze) #1299

Found during the v0.11.1 release review (CTO persona). Deferred because: the durable fix is an architectural change to how Npm.Service.install runs.

v0.11.1 (#1292) fixes the fresh-install freeze for the common case by only installing @opencode-ai/plugin into config dirs that can import it. But the underlying mechanism, an in-process @npmcli/arborist reify() on Bun's event loop inside the config layer (packages/core/src/npm.ts), is mitigated, not removed. A user whose config dir has a local tool/ or plugin/ source and no node_modules yet still hits the same class of multi-minute stall on first run, and the starved EffectFlock heartbeat / stolen npm-install:<dir> lock failure mode is still reachable.

Suggested fix. Run the reify in a worker thread or child process (or shell out to bun install), and keep Config.waitForDependencies() as the only synchronization point. The new event_loop_stall telemetry (#1294) and the cold-start-regression CI job give a way to verify the improvement.