sdx 1.0.0-alpha13

Changed
- Module and theme install/uninstall hooks no longer resolve npm dependencies over the network. The hooks synchronously re-resolved the whole dependency graph against registry.npmjs.org whenever the enabled extension set changed, putting minutes of network I/O inside the module install lifecycle: pm:install depended on registry availability, and on hosts with a low MySQL wait_timeout the idle connection died mid-install ("MySQL server has gone away" with half-written caches). The hooks now only check staleness against local files and log an actionable notice; drush sdx:resolve - which has always reconciled the lockfile itself before installing - is the single place resolution happens. A new status
report row ("SDX: Dependency lockfile") warns while sdx.lock is out of date.
Installing SDX modules now works fully offline.

Fixed
- Cold dependency resolution fetches registry package documents through a bounded concurrent pool instead of one serial round-trip per package. A large manifest set resolves in a few seconds instead of minutes, and because each response is cached to the database as it settles, the connection sees regular activity for the whole phase - closing the "gone away" window that remained in sdx:resolve's resolution phase after 1.0.0-alpha12 covered the install child process. Failed fetches fall back to the sequential path, which reports them with full context.