Make qm init pin the executing CLI version

[mariohercules]

Problem

qm init claims to write the version it resolved to as an exact dependency. However, packageContent preserves any existing string at dependencies["@yc-software/qm"]:

• an older exact version
• a semver range
• latest
• a local file: artifact

For registry specifications, the subsequent npm install can therefore install a different CLI from the one that generated the deployment files. This can leave the generated deployment incompatible with its installed CLI.

Expected behavior

qm init should replace registry dependency specifications with cliVersion(), while preserving intentional local package artifacts used by development and packed-artifact tests.

Acceptance criteria

• Existing exact, ranged, tag, and other registry specifications are replaced with the executing CLI version.
• Supported local dependency forms remain usable.
• Tests cover both registry and local dependency inputs.
• The deployment documentation accurately describes the resulting pin.

[Ar9av]

Opened #68. packageContent now writes cliVersion() for every registry dependency spec — exact, ranged, or tagged — and only keeps the existing string when it's a local dependency (file: or link:). Tests cover both the registry-replacement and local-preservation paths, and deployment.md now describes the pin correctly.