library builder: tslib is not added to the output package.json

Command

build

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

Found while testing #34106 cc @alan-agius4

When emitted bundle imports tslib helpers and library's own package.json doesn't declare tslib, the built package declares none either. ng-packagr adds it, taking the range from @angular/compiler (^2.3.0 today). On ng-zorro-antd 34 of the 105 bundles import tslib and the library-builder output has no dependencies field at all.

With hoisting (plain npm, default pnpm) it resolves anyway. In a strict layout (pnpm with hoisting off) the consumer gets ERR_MODULE_NOT_FOUND ... 'tslib', and an app build fails to resolve it.

Minimal Reproduction

1. a library with importHelpers: true, target ES2022 and a standard decorator on a class, so TypeScript emits __esDecorate / __runInitializers
2. the library's package.json declares only a peer dependency on @angular/core
3. build with both builders: both emit import { __esDecorate, __runInitializers } from "tslib" into fesm2022
4. ng-packagr's output package.json has "dependencies": { "tslib": "^2.3.0" }, the library builder's has no dependencies
5. install the library-builder output in a non-hoisted layout and import it: Cannot find package 'tslib'

Exception or Error

Your Environment

@angular/build built from #34106 (005e05ee) with the repo's own bazel build
Angular CLI 22.1.8
Angular 22.1.7
Node 24.16.0
npm 11.13.0
macOS 26.6, 14 cores, 24 GB

Anything else relevant?

ng-packagr does this in writePackageJson (write-package.transform.ts): if neither dependencies nor peerDependencies has tslib, it reads @angular/compiler's own range and writes it into dependencies. generatePackageManifests has no equivalent step. validateDependencies in build-action.ts already skips the tslib key when checking against allowedNonPeerDependencies, so the builder expects it to be there.

Declaring tslib in the library's own package.json works today and is carried through unchanged.