fix(cli): declare release and DOM test dependencies

[c8dhjp4tyv-bit]

Summary

• declare tar, which the release launcher and wrapper safety tests import in the private CLI workspace
• declare @types/react-dom, which the CLI's server-rendering tests require for typechecking
• update bun.lock with the minimal dependency graph changes

tar intentionally remains a CLI workspace devDependency: the actual published wrappers (cli/release, cli/release-staging, and freebuff/cli/release) each already declare tar in their own runtime dependencies.

Validation

• CLI typecheck passes with exit code 0
• release wrapper repair test passes
• DOM-rendering component tests pass
• runtime smoke import confirms tar.c and renderToStaticMarkup resolve
• verified the tar 7 lockfile graph keeps incompatible older consumers nested (tar-fs/chownr@1.1.4, lru-cache/yallist@4.0.0) rather than upgrading them transitively
• git diff --check passes
• the fork-triggered Public CI workflow is currently action_required, so there is no completed GitHub CI result to claim yet