chore: prepare Destroyer for Askr 0.5.0

[smiggleworth]

Prepare Destroyer to consume the Askr 0.5.0 package graph.

Changes

• Move all nine Askr runtime dependencies and @askrjs/vite to the >=0.5.0 <0.6.0 range.
• Use the Vite+ test entry point across the unit and production test files.
• Regenerate the lockfile against the exact 0.5.0 candidate artifacts, retaining canonical npm registry URLs and package integrity values.

Local qualification

• Node 24.21.0 and npm 12.0.1.
• Clean npm ci passed against the temporary read-only candidate registry.
• npm run acceptance passed: lint, typecheck, 53 unit tests, build, 4 production tests, 72 browser tests, and 3 development finding tests. One CSP nonce test remains explicitly skipped as outside this release scope.
• Full and production npm audit both report zero vulnerabilities.
• package-lock.json SHA256: 26135ba0165027dced1fc4053ac2dddb8b794e985a0276a79dcfb1a3d73214f3.

The Askr 0.5.0 packages are not published yet, so hosted clean installs can return npm E404 until the producer versions are released. Local qualification used the frozen candidate graph; after producer integration, regenerate/recheck this consumer lock against the final develop graph.

This PR targets develop for review. It does not promote to main or publish packages.

Hosted develop checks

The CI workflow now runs for pull requests targeting develop as required by the active branch ruleset. Run 38337854744 posted the required CI matrix and Browser product flows; each failed at clean npm ci with E404 for the unpublished @askrjs/vite@0.5.0. The canonical visual census hit the same E404 during its Docker image install. Local exact-graph install, full acceptance, and full/production audits passed as described above. This is the expected prepublication limitation; the required hosted statuses must pass once the package is public before this PR can merge.