open-app: enforce declared version ranges on fresh dependency installs (successor to #2713)

#2713 was closed as completed (2026-06-02), but the first limitation it documents is still present in code: declared version ranges are validated only for **already-installed** dependencies — `CheckDependencyVersionCompatibility` is called with `installed.Version` from `dependency-graph-builder.ts:207` and `dependency-resolver.ts:159` only, so a **fresh transitive install** never has its range checked (including diamond conflicts). Commit 337d26e0fb pinned these documented limitations with regression tests rather than closing the gap.

This matters more under the LTS process (PR #3241 §3.2): app compatibility is "declared ranges + CLI enforcement," so the enforcement half must cover the fresh-install path before apps lean on the contract. Tracked under punch item 10 in `plans/lts-process.md`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_019EfGkq8cW9drueo1vEN4sM

Read dependency-graph-builder.ts around line 207 and dependency-resolver.ts around line 159, then review the regression tests added by commit 337d26e0fb. Trace the fresh transitive-install path and its diamond-conflict handling. Done means declared version ranges are enforced for fresh installs, with regression coverage for the remaining limitation.

Written by the indexing model from the issue text.