chore(deps): remove any-constraints, prune the dependency_overrides graveyard, set a pinning policy

## Problem
(verified) dev_dependencies are all `any` (`test`, `json_serializable`, `build_runner`, `mockito`, `flutter_lints` — pubspec.yaml), making CI builds non-reproducible over time; ~40 lines of commented-out `dependency_overrides` obscure what is actually in play; carp packages are caret-ranged with no stated policy.

## Proposed fix
Version the dev deps; delete the commented overrides (document the local-path-override workflow in README/docs instead); adopt a policy — caret + committed `pubspec.lock` (recommended) + scheduled `pub outdated` check in CI (#585).

**Decision needed:** caret-with-lock vs. hard pins for `carp_*`.

## Acceptance criteria
- [ ] No `any` in pubspec
- [ ] Overrides section reduced to a documentation pointer
- [ ] CI job reports outdated CAMS packages

**Effort:** S · **Priority:** P2 · **Change risk:** None