Alternate package manager support in deploy_component (yarn/pnpm for reference and payload deploys)

The parent task CORE-2824 ("Support multiple package managers") is marked Done — the `devEngines.packageManager` detection was wired up. Two remaining subtasks in Backlog cover the deploy paths:

## CORE-2825 — Payload deploy (deploy by zipped payload)

When a component is deployed via payload (tarball/zip rather than a git reference), the package manager used to install dependencies needs to be detected from the package's `devEngines.packageManager` or `engines.packageManager` field and honored. Today only npm is guaranteed to work.

## CORE-2826 — Reference deploy (deploy by git URL)

When a component is deployed by git reference (e.g. `git+ssh://...`), the same package manager detection and invocation should apply — yarn or pnpm should be used if declared.

## Acceptance criteria (both paths)

- `devEngines.packageManager` (or `engines.packageManager`) in the component's `package.json` is read.
- The correct binary (`yarn`, `pnpm`, or `npm`) is invoked for dependency installation.
- If the declared package manager binary is absent on the host, a clear error is returned.
- Documented.

## Related

- [CORE-2903](https://harperdb.atlassian.net/browse/CORE-2903) / [HarperFast/harper#661](https://github.com/HarperFast/harper/issues/661) — "use `npm install ` for non-source packages" also touches the install path.

---

🤖 Filed by Claude on behalf of Kris.