scripts: add Check-Deps pre-flight (mods.toml ground truth)

Adds scripts/Check-Deps.ps1 and wires it into Deploy-Brass.ps1 as a
pre-flight gate when Stage includes Pack. The script parses each lockfile
jar's META-INF/neoforge.mods.toml directly -- the same source the loader
reads at startup -- and refuses to deploy if any [[dependencies]] block
with type=required (default) names a modId that nobody in the pack
provides.

Handles three real edge cases discovered during initial run:

1. Jar-in-jar bundled deps: Create ships Ponder, Registrate, Flywheel
   embedded under META-INF/jarjar/. The script recurses into those and
   counts their modIds as present, since the loader auto-loads them.

2. Language-provider jars (Kotlin for Forge) have no standard mods.toml
   -- they declare via a different mechanism. Tiny slugToImplicitModId
   override map (currently 1 entry) covers them.

3. Non-mod lockfile entries (shaderpacks under shaderpacks/, configs
   under config/, etc.) are skipped explicitly by path prefix check.

Vanilla deps (minecraft, neoforge, forge, fabric, java, javafml, etc.)
are pre-seeded as present.

Jars cached at /tmp/bns-check-deps-cache/<sha1>.jar; second-run cost is
~1.5s. First run downloads ~150MB.

The script would have caught the v0.15.0 -> v0.15.1 incident: Slice &
Dice's jar declares kotlinforforge required in mods.toml even though
Modrinth's dep field only lists Create. The Modrinth-only check (earlier
draft) wouldn't have helped; the mods.toml-based check does.

scripts/Deploy-Brass.ps1

@@ -118,6 +118,17 @@ if (($shouldRunPack -or $shouldRunLauncher) -and -not $DryRun -and -not $Force)
     }
 }
 
+# ─── Pre-flight: required-dependency check ─────────────────────────────────
+# Walks each Modrinth mod in pack.lock.json, fetches its 'required'
+# dependencies, and refuses to deploy if any aren't already in the lockfile.
+# Catches the failure mode where adding a mod that hard-deps on (say)
+# kotlinforforge crash-loops the daemon at startup. Only runs when pack
+# content is changing; -Force skips it (rarely needed).
+if ($shouldRunPack -and -not $DryRun -and -not $Force) {
+    Write-Host "Pre-flight: validating Modrinth dependency graph..." -ForegroundColor DarkGray
+    & (Join-Path $here 'Check-Deps.ps1')
+}
+
 # ─── Pre-flight: was the daemon already running? ───────────────────────────
 # We don't auto-stop it (kicks active players to fix a problem that isn't
 # actually broken -- the atomic swap is safe with the daemon running). But