sdx 1.0.0-alpha15

Fixed
- sdx_router: components arriving via soft navigation hydrate again. The SPA asset loader injected the incoming page's scripts as bare

tags, dropping type="module" - Vite-built chunks are ES modules, so they crashed on arrival with "Cannot use import statement outside a module" and the affected components stayed server-rendered but inert until a hard reload. The two fallback extraction paths were quieter but no better: both excluded module scripts entirely, shipping no module chunks at all. Script references now carry their type end to end: the envelope emits {src, type} objects for ES-module scripts (classic scripts stay plain URL strings, so the wire shape is backward compatible), every extraction path includes module scripts, nomodule fallbacks are skipped, and the loader stamps the carried type on the tags it injects. - The generated build package.json can no longer contain unpinned ("*") dependencies, and builds refuse to run against a stale sdx.lock. Framework vite plugins are registered with a "*" placeholder that the sdx.lock overlay pins; with a stale lock the wildcard survived and npm installed the newest publish - which broke globally the day @vitejs/plugin-react 6 (peer vite ^8) released against locked vite 7 (ERESOLVE on every fresh build-config install). Now sdx:build fails immediately with "sdx.lock is stale ... Run drush sdx:resolve" when the lock does not match the enabled manifests, and any build dependency left without a pin or concrete version aborts config generation naming the package. Concrete versions from legacy out-of-tree plugin specs keep working.