chore: add ci check requiring deps: commits for prod dependency changes

[reggi]

What / Why

Adds a new Pull Request CI check that rejects a PR when a production dependency is changed without a dedicated deps: commit naming that dependency. This keeps dependency updates isolated in the git history and changelog, and prevents prod dep bumps from being buried inside unrelated fix:/feat:/chore: commits.

Motivated by #9740, where a deps(arborist): validate-npm-package-name ^8.0.0 bump was merged inside a single fix: commit, obscuring why arborist needed a version bump.

How it works

scripts/check-deps-commits.js (git + Node builtins only — no dependency install required):

• Diffs first-party manifests (root package.json, workspaces/*, mock-registry, …) across base...head, excluding node_modules/** bundle churn.
• Collects every changed dependencies entry (ignores devDependencies).
• Requires each changed dep to be named in a deps: / deps(scope): / deps!: commit in the branch.
• On failure, prints the missing deps and a suggested scoped, versioned commit derived from the diff, e.g. deps(arborist): validate-npm-package-name@^8.0.0.

.github/workflows/deps-commits.yml runs it on PRs and skips bot release/v* branches (which bulk-bump interdependencies in one chore: release). Intentionally not template-oss managed.

Example (what #9740 would have shown)

The following production dependency changes are missing a matching deps: commit:
  - validate-npm-package-name (changed in: workspaces/arborist/package.json)

Add a separate commit for each, e.g.:
  deps(arborist): validate-npm-package-name@^8.0.0

Verification

• Regression fix: correct bundled sigstore from dev dependency conflict #9740 merge commit → fails (exit 1) ✅
• deps: tar@7.5.19 (root prod dep bump) → passes ✅
• mock-registry arborist devDep bump → correctly ignored ✅
• ESLint clean; workflow YAML valid.