Revert scaffold @webjsdev/* + drizzle exact pins to semver ranges (after #698)

[vivek7405]

Problem

#692 changed the scaffold to EXACT-pin @webjsdev/* and drizzle (drizzle-orm / drizzle-kit / pg) in generated apps. The stated reason (see packages/cli/lib/create.js:85-98, SCAFFOLD_DEP_VERSIONS) is that under Bun zero-install a ^ range resolved to absolute LATEST (ignoring the range), so an exact pin was the only way to get a predictable version and keep npm + bun identical.

PR #698 removes that reason: Bun zero-install now resolves an inline range the standard way (zod@^3.20.0 picks the highest 3.x), because webjs forwards the declared range into the inline specifier. So the scaffold can go back to idiomatic ^ ranges, which auto-pick patch/minor updates the way an npm user expects.

Design / approach

Once #698 is merged, revert the scaffold to ^ ranges for @webjsdev/* and the drizzle/pg deps. Two caveats to verify, not assume:

1. Drizzle "wrong major" concern (Make npm and bun scaffolds resolve consistent package versions (#682 follow-up) #692). drizzle's npm latest tag is a 0.x line while the scaffold targets the 1.0.0-rc.x relations-v2 line. Confirm that a RANGE like ^1.0.0-rc.3 resolves to the 1.x RC under Bun zero-install (a range is resolved by semver, not by the latest dist-tag, so it should pick the highest 1.x-rc, NOT the 0.x latest). If caret-with-prerelease behaves unexpectedly, use a comparator range (>=1.0.0-rc.3 <2) or keep drizzle exact while ranging the rest.
2. Determinism. Make npm and bun scaffolds resolve consistent package versions (#682 follow-up) #692 also wanted npm and bun to resolve identically. With ranges, they can drift over time. Decide whether the scaffold should also commit a bun.lock (its exact pin then wins via the feat: forward inline-safe ranges in the bun zero-install pin rewrite #698 precedence) so a fresh app is still reproducible, or accept range drift as normal npm semantics.

Implementation notes (for the implementing agent)

• Where: packages/cli/lib/create.js (SCAFFOLD_DEP_VERSIONS at L94-98, and the @webjsdev/* version resolution around L60-95 that fs-reads each pkg's installed version); packages/cli/templates/ generated package.json shapes.
• Landmine: this depends on feat: forward inline-safe ranges in the bun zero-install pin rewrite #698 (the range-forwarding + the zero-install gate). Do NOT land it before feat: forward inline-safe ranges in the bun zero-install pin rewrite #698 is on main, or a scaffolded Bun zero-install app gets absolute-latest again.
• Update the Make npm and bun scaffolds resolve consistent package versions (#682 follow-up) #692 rationale comment in create.js and the runtime docs (agent-docs/runtime.md, docs/app/docs/runtime/page.ts, root + scaffold AGENTS.md) which currently say the scaffold pins exact for npm/bun consistency.
• Tests: the test/scaffolds/ suite (a freshly scaffolded app passes webjs check + webjs test); add a Bun zero-install assertion that a scaffolded app resolves the intended major/minor for drizzle.

Acceptance criteria

• Scaffold generates ^ ranges for @webjsdev/* and drizzle/pg (or a documented exception for drizzle if the RC range misbehaves).
• A scaffolded Bun zero-install app resolves the correct drizzle 1.x-rc major (verified, not assumed).
• Determinism decision recorded (commit bun.lock vs accept drift).
• Make npm and bun scaffolds resolve consistent package versions (#682 follow-up) #692 rationale comment + runtime docs updated.

Depends on #698. Relates to #692, #697.