fix: add pkce-challenge as a runtime dependency

[kingmarh-hash]

Summary

• declare pkce-challenge as a published runtime dependency
• update the lockfile so the package is installed for production consumers

Fixes #17.

Verification

• PUPPETEER_SKIP_DOWNLOAD=1 npm ci
• npm run bundle
• npm pack --json --silent
• installed the generated tarball into a fresh temp project with --omit=dev and confirmed:
  • await import("@vibebrowser/chrome-devtools-mcp/build/src/third_party/index.js") succeeds
  • import.meta.resolve("pkce-challenge") resolves to the installed package
  • npm ls pkce-challenge --all shows @vibebrowser/chrome-devtools-mcp -> pkce-challenge@5.0.1

Note: npm run verify-npm-package currently exits because npm dry-run refuses the already-published 0.26.6 version; npm pack --json --silent succeeded and was used for the install smoke test.