fix: reproducible build — pin deps, patch commander, move stubs to stubs/

- Move private package stubs to stubs/ (tracked), reference via file: in package.json
  Stubs: color-diff-napi, modifiers-napi, @ant/claude-for-chrome-mcp,
         @anthropic-ai/mcpb, @anthropic-ai/sandbox-runtime
- Add patches/commander@14.0.3.patch via pnpm patch:
  Allow multi-char short flags (/^-[^-]+$/) so -d2e works with commander v14
- Pin all dependency versions to exact versions from original cli.js bundle
  (extracted from node_modules package.json files in source map)
- Add @anthropic-ai/bedrock-sdk, foundry-sdk, vertex-sdk to dependencies
- Update .gitignore: node_modules/ fully ignored (regenerated by pnpm install)
- Update scripts to use plain `bun` instead of hardcoded path
- Verified: rm -rf node_modules && pnpm install && bun run build.ts succeeds
  Output: dist/cli.js (22.1MB), `bun dist/cli.js --version` → 2.1.88 (Claude Code)

claude-code-source/patches/commander@14.0.3.patch

@@ -0,0 +1,15 @@
+diff --git a/lib/option.js b/lib/option.js
+index 4a0bd7fac72a8fcfcec620efd78c517dcc7045b8..353a09f34262a47727f7dfc1837fafa4d63f25e1 100644
+--- a/lib/option.js
++++ b/lib/option.js
+@@ -328,8 +328,8 @@ function camelcase(str) {
+ function splitOptionFlags(flags) {
+   let shortFlag;
+   let longFlag;
+-  // short flag, single dash and single character
+-  const shortFlagExp = /^-[^-]$/;
++  // short flag, single dash and one or more characters (allow multi-char like -d2e)
++  const shortFlagExp = /^-[^-]+$/;
+   // long flag, double dash and at least one character
+   const longFlagExp = /^--[^-]/;
+