Genie packageJson crashes when a dependency version is undefined

packageJson(...).stringify(...) crashes in resolveDeps when a dependency map contains an undefined value. The crash is an unstructured TypeError, so the generated failure does not identify the malformed dependency entry.

Reproduction

https://github.com/schickling-repros/2026-06-genie-undefined-dependency-version

bun run repro

The repro uses a synthetic package and imports the public Genie source at commit b0d1daea4e21468f9813f39a234732456d8e2764.

Expected

Genie should report a structured validation/generation error that identifies the dependency key whose version is not a string.

Actual

TypeError: undefined is not an object (evaluating 'version.startsWith')
    at resolveDeps (.../packages/@overeng/genie/src/runtime/package-json/mod.ts:414:9)
    at buildPackageJson (.../packages/@overeng/genie/src/runtime/package-json/mod.ts:521:21)
    at stringify (.../packages/@overeng/genie/src/runtime/package-json/mod.ts:722:11)

Minimal trigger

packageJson({
  name: 'synthetic-package',
  version: '1.0.0',
  dependencies: {
    valid: '1.0.0',
    malformed: undefined,
  } as unknown as Record<string, string>,
}).stringify({ location: '.', cwd: process.cwd() })

Versions

• overengineeringstudio/effect-utils: b0d1daea4e21468f9813f39a234732456d8e2764
• Bun: 1.3.13
• OS: Linux x64

Start in packages/@overeng/genie/src/runtime/package-json/mod.ts at resolveDeps around line 414, then follow buildPackageJson and stringify. Run the linked reproduction with bun run repro and verify that an undefined dependency version produces a structured error identifying its dependency key instead of a TypeError.