Pin signing-path dep ranges and make vendor SDKs optional/lazy

[its-everdred]

Problem

The SDK signing path relies on third-party packages for signer construction, smart-wallet address derivation, calldata building, and protocol validation. The published package manifest currently allows consumers to resolve versions outside the graph CI exercised, while hosted-wallet SDK peers are hard, unbounded, and reachable through eager value exports.

This overlaps #131, which tracks peer dependency install/build behavior. This issue covers the broader manifest and lazy-export hardening from the prod-ready planning ticket.

Solution

• Constrain signing-path runtime dependency ranges, especially viem, permissionless, and Morpho packages, to tested minor bands.
• Move viem to a peer dependency with a matching dev dependency so consumers can dedupe to the tested boundary.
• Add upper bounds to hosted-wallet peer ranges.
• Mark hosted-wallet peers optional in peerDependenciesMeta.
• Avoid eager value exports that pull optional hosted-wallet packages into consumers that do not use them.

Acceptance criteria

• packages/sdk/package.json constrains signing-path packages to the tested bands.
• Hosted-wallet peer ranges have upper bounds instead of bare >= ranges.
• Hosted-wallet peers are marked optional.
• Node/react wallet barrels do not value-export optional vendor implementations from the root eager graph.
• The PR description references the overlap with Test that peer dependencies work as expected and the sdk builds without all dependencies installed #131.