feat: Create and reconcile local setup locks (#14473)
Create and reconcile Node/exact-pnpm locks through local `turbo setup
--tools-only`. Implements TURBO-6334; builds on merged #14472 and
targets `main`.
```text
Captured declarations
→ Resolve new or changed selections; preserve unchanged pins
→ Validate the current-host plan
→ Atomically create/update turbo.lock
→ Provision the exact committed selection
```
- Honor existing frozen/CI behavior and the read-only check path.
- Report lock creation, updates and removals with a commit reminder.
- Retain original root/source/config/lock expectations through
publication and installation.
- Preserve native package-manager advisory semantics and reject
unsupported selections before writers.
No dependencies or tasks are run. Tools-only is still explicit; refresh,
force, no-lock and other controls are separate slices. Managed-run
authorization, npm override CLI support, platform promotion, and public
capability advertising remain separate work.
