build(deps): move @intx/* to 0.4.0 (CL-8797)

[TheGreatAxios]

Summary

Moves every @intx/* npm dependency to 0.4.0, then retires the vendored
@intx/mailbox/@intx/mime/@intx/types copies now that all three are
published on npm for the first time.

Package	Before	After	Field
@intx/crypto	0.3.0	0.4.0	dependencies
@intx/log	^0.2.2	^0.4.0	peerDependencies
@intx/log	0.2.2	0.4.0	devDependencies
@intx/mailbox	workspace:* (vendor/)	^0.4.0	peerDependencies (new)
@intx/mailbox	workspace:*	0.4.0	devDependencies
@intx/mime	workspace:* (vendor/)	^0.4.0	peerDependencies (new)
@intx/mime	workspace:*	0.4.0	devDependencies
@intx/types	workspace:* (vendor/)	^0.4.0	peerDependencies (new)
@intx/types	workspace:*	0.4.0	devDependencies

Two commits

1. build(deps): move @intx/* to 0.4.0 — the version bump itself, plus
   semver/@types/semver devDependencies needed at that point because
   the workspace:* → npm swap made bun stop treating vendor/intx-*
   as workspace members (their own dependencies/devDependencies
   stopped installing).
2. refactor(deps): retire vendored @intx copies now that @intx/mailbox is on npm — the full cutover, described below.

Why the cutover, and why now

VENDORED.md's kill condition for all three vendored rows was "first
npm publish of @intx/mailbox" — that publish landed as part of this
0.4.0 wave (confirmed via npm view @intx/mailbox versions, which now
lists only 0.4.0). The reason for vendoring (nothing on npm for a
consumer to install) no longer holds, so this commit finishes the
retirement VENDORED.md itself describes as the end state.

What changed

• Deleted vendor/intx-mailbox, vendor/intx-mime, vendor/intx-types,
  VENDORED.md, and tsconfig.vendor-build.json.
• package.json: dropped vendor/* from workspaces. @intx/mailbox,
  @intx/mime, @intx/types move to peerDependencies (^0.4.0) plus
  a matching exact devDependencies pin (0.4.0) — the same treatment
  @intx/log already had here. Checked corbits-artifacts' package.json
  for the established convention: every @intx/* package its src
  imports (including ones used at real runtime, e.g. @intx/hub-api's
  idResource, @intx/agent's defineTool) is declared only under
  peerDependencies + a pinned devDependencies entry, never under
  plain dependencies — so @intx/mime/@intx/types follow that same
  pattern even though they're pure runtime/internal-only imports here,
  not part of this package's own exported type surface. Also dropped
  the semver/@types/semver devDependencies added in the first
  commit — nothing outside vendor/ needed them once vendor/ is gone.
  Bumped corbits.minimumIntxVersion and the description's "Requires
  @intX ..." line from 0.2.2 to 0.4.0 to match.
• scripts/build.mjs: dropped the vendor-build tsc pass, the copy
  into dist/vendor/, and the bare-specifier rewrite step. The build is
  now a plain tsc emit of src/ (matching corbits-artifacts' build
  script) — dist/*.js now ships bare @intx/mailbox/@intx/mime
  specifiers for a consumer's own install to resolve, the same as
  @intx/log already did. Verified dist/vendor/ no longer exists and
  dist/mount.js/dist/frame.js import @intx/mailbox/@intx/mime as
  bare specifiers.
• Comments (src/index.ts, src/mount.ts, src/native-store.ts,
  src/native-store.test.ts) and one README sentence that called these
  packages "vendored" now name @intx/mailbox directly — including one
  string that ships in the OpenAPI description field, so it was
  user-facing, not just an internal comment.
• README: Peers: line and the four package-manager install lines in
  Quickstart now list @intx/mailbox, @intx/mime, @intx/types
  alongside @intx/log.

examples/reference-host was NOT bumped — reported, not improvised

examples/reference-host's own @intx/db/@intx/hub-api/@intx/hub-sessions
deliberately stay at 0.2.2. Bumping them to 0.4.0 (tried, then
reverted) surfaces real, non-trivial API breaks unrelated to the
mailbox/mime/types cutover, all in examples/reference-host/src/index.ts:

• SidecarCredentialIdentity is now a discriminated union
  ({ kind: "allocated" | "probe", ... } with several more required
  fields) — the reference host's { kind: "sidecar", sidecarId } no
  longer satisfies it.
• SessionService dropped deployInstanceAtHead.
• SidecarRouterConfig now requires validateSidecarIdentity in
  addition to authenticateSidecar.

These are real behavior/API changes with no drop-in replacement visible
from the type errors alone — per this bump's own rule ("if 0.4.0 breaks
something non-trivially... stop, do not improvise a fix, report the
details instead"), that wiring was left untouched rather than guessed
at. examples/reference-host already had an unrelated pre-existing
typecheck gap noted in the original bump commit's baseline, so it was
out of scope for that reason too.

Checks vs baseline (main, no Postgres provisioned locally)

• typecheck (bun run typecheck, after bun run build +
  bun install --force, matching CI): clean, same as baseline and as
  the prior commit.
• lint / format: no lint or format script exists in this repo.
• tests (bun test src): baseline was 56 pass / 91 fail / 147
  tests / 19 files. This branch: 47 pass / 91 fail / 138 tests / 18
  files — fail count is unchanged; the 9-test/1-file drop is exactly
  vendor/intx-types/src/sidecar-oauth-login.test.ts, which no longer
  exists because the vendored copy it tested is deleted. No new
  failures anywhere in this package's own src/ tests.
• examples/reference-host acceptance test: unchanged (1 fail, same
  Postgres-connection error as baseline — untouched by this PR).
• Pack smoke test: npm pack, confirmed vendor/ is absent from
  the tarball, installed the tarball fresh in a scratch directory
  (npm install, which auto-installs peers), and ran the same node
  consumer check CI does (mountMailbox/runMailboxMigrations both
  resolve) — "node consumer ok", @intx/mailbox/@intx/mime/@intx/types/
  @intx/log/@intx/crypto all present under node_modules/@intx/.
• Both README ts code fences still typecheck clean against the
  cutover source.
• No stray lockfiles.

Part of CL-8797