API/TypeSchema: respect tree shaking and fix package attribution in introspection output

[ryukzak]

Introspection fixes

• `introspection({ fhirSchemas, structureDefinitions })` now dumps only schemas present in the (tree-shaken) TypeSchema index, mirroring the existing `typeSchemas` behavior. Previously both options dumped the entire register.
• `allSd()` now stamps the fallback `package_name`/`package_version` from the resolution's source package instead of the containing package index, so StructureDefinitions are attributed to the package that actually declares them.

Both problems surfaced when generating a tree-shaken profile from a multi-package canonical-manager input (`kbv.basis@1.9.0`, single profile):

Before:

introspection (5535 files, 2967 kloc):
  fhir-schemas/...                          2579 files across 11 packages
  structure-definitions/kbv.basis/          2579 files  <- every SD, incl. R4 core, attributed to kbv.basis

After:

introspection (499 files, 56 kloc):
  fhir-schemas/hl7.fhir.r4.core/            60 files
  fhir-schemas/kbv.basis/                   1 file
  structure-definitions/hl7.fhir.r4.core/   62 files
  structure-definitions/de.basisprofil.r4/  1 file
  structure-definitions/hl7.fhir.uv.extensions.r4/ 1 file
  structure-definitions/kbv.basis/          2 files

CI fixes

• Cherry-picked the bun audit fix from Chore: fix bun audit brace-expansion advisory (#1634) #198 (closed in favor of this PR): bump `brace-expansion` override `>=5.0.6` → `>=5.0.7` for GHSA-3jxr-9vmj-r5cp (high, DoS) — fixes the `security` job. Internal ref: #1634.
• Cherry-picked `fix(typeschema): stabilize collision ordering` from TypeSchema/TS: Preserve sliced choice semantics #196 — fixes platform-dependent collision auto-selection drift that failed the US Core example jobs; regenerating both examples now reproduces the committed output byte-for-byte.

[ryukzak]

Added two commits to make CI green:

• cherry-picked the bun audit fix from Chore: fix bun audit brace-expansion advisory (#1634) #198 (now closed): brace-expansion override >=5.0.7 for GHSA-3jxr-9vmj-r5cp — fixes the security job
• cherry-picked fix(typeschema): stabilize collision ordering from TypeSchema/TS: Preserve sliced choice semantics #196 — fixes the platform-dependent collision auto-selection drift that failed test-typescript-r4-us-core-example / test-python-r4-us-core-example (regenerating both examples locally now reproduces the committed output byte-for-byte)