Pin wrangler for telemetry deploys via committed lockfile

[ParallelEntrepreneur]

What changed and why:
Issue #103: the production telemetry worker was deployed by hand with bare
npx wrangler, which resolves wrangler@latest from npm at deploy time —
the repo's one deploy-time dependency with no pin or hash under the repo's
control. Fixed as suggested in the issue:

• services/telemetry/package.json: added exact devDependency
  "wrangler": "4.135.0" (no caret), so npx wrangler resolves the pinned
  local install and dependency audits cover the deploy tool.
• services/telemetry/package-lock.json: expanded by npm to lock the full
  wrangler tree (this file was already tracked at HEAD by Pin the runtime inputs, attest the release, and audit dependencies in CI #105; this change
  only grows it).
• services/telemetry/wrangler.toml header comment and
  docs/telemetry.md "Running the service": deploy commands now use
  npx --no-install wrangler, which refuses to fetch from the registry and
  fails closed if the pinned install is missing; docs note to run npm ci
  first on a fresh checkout so deploys use the committed lockfile.

How verified:

• npx --no-install wrangler --version from services/telemetry/ → 4.135.0.
• npm test in services/telemetry/: 11 pass, 0 fail.
• git status --short shows only the 4 intended files; no stray root-level
  files or scratch artifacts left behind.

Reviewers / merge notes:

• Size: 4 files, 1591 insertions, 6 deletions — almost all of it the
  generated package-lock.json (+1582 lines from wrangler's dependency
  tree). This exceeds the 400-line soft ceiling, but it is machine-generated
  lockfile content that genuinely needs committing for the pin to work; the
  hand-written diff is 3 small files. Hand-review only package.json,
  wrangler.toml, and docs/telemetry.md.
• Overlap: services/telemetry/package-lock.json was introduced at HEAD by
  the Pin the runtime inputs, attest the release, and audit dependencies in CI #105 PR for SBOM coverage; this change builds on it (adds wrangler as
  a declared dependency) rather than conflicting with it.

Closes #103

---

🤖 Generated by Colonizer in a microVM