refactor: move the in-process arborist reify off the event loop (durable fix for the first-run freeze)

Found during the v0.11.1 release review (CTO persona). Deferred because: the durable fix is an architectural change to how `Npm.Service.install` runs.

v0.11.1 (#1292) fixes the fresh-install freeze for the common case by only installing `@opencode-ai/plugin` into config dirs that can import it. But the underlying mechanism, an in-process `@npmcli/arborist` `reify()` on Bun's event loop inside the config layer (`packages/core/src/npm.ts`), is mitigated, not removed. A user whose config dir has a local `tool/` or `plugin/` source and no `node_modules` yet still hits the same class of multi-minute stall on first run, and the starved EffectFlock heartbeat / stolen `npm-install:` lock failure mode is still reachable.

**Suggested fix.** Run the reify in a worker thread or child process (or shell out to `bun install`), and keep `Config.waitForDependencies()` as the only synchronization point. The new `event_loop_stall` telemetry (#1294) and the `cold-start-regression` CI job give a way to verify the improvement.