Adopt mdbase 0.3.0-rc.8 and install packs with upgrade_from

[callumalpass]

Why

@callumalpass/mdbase 0.3.0-rc.5 rejected type packs whose seed type resources carry upgrade_from ("must NOT have additional properties"), so #53 added referenceInstallerProvision() to strip it before local verification. rc.5 also rejected create({ type }) when the type's match rule did not hold under an explicit type key (match_failed), so #55's test wrote the view record by hand. rc.8 supports upgrade_from for seed types with the Rust engine's semantics, and explicit creates skip match (fixed in rc.6).

What

• Bump @callumalpass/mdbase to 0.3.0-rc.8 (root package.json, the only dependent); lockfile updated.
• Remove referenceInstallerProvision(). verify-manifest.mjs and reader-type-pack.test.mjs pass the real provisions, upgrade_from included, to assessTypePack/applyTypePack. verify-manifest also asserts that each pack plans install into an empty collection.
• Digest pins come from the installer's desired.digest again, as they did before Stop Reader's starter types pinning the type key #53. This includes the beta.3 pack rebuilt from the baselines and the mdbase.view 1.0.1 pack. The pinned values are unchanged and match the canonical-JSON pins and mdbase packs assess.
• New tests:
  • beta.3 → beta.4 over an unedited seed: both seeds plan update and are written as the exact version-2 bytes. The collection is current afterwards.
  • beta.3 → beta.4 over an edited seed: the three-way merge plans update, and the result is version 2, keeps the collection's edit and no longer declares or requires type.
• The beta.1 → beta.4 test changes for original-beta.1. Its seeds are edited version-1 starters, so they are now merged (update) rather than preserved, and the merge keeps the appended customisation. changed-beta.1 still preserves.
• The view-record test calls V03Operations.create({ type: "view", ... }) under [type] and [mdbase_type] instead of writing the file by hand. It checks the type key written and that type: article-journal stays ordinary data.
• rc.7 resolves wikilinks by ID only when id_field is configured. The annotation in the type-key test now links its source by path ([[sources/example|Example source]]), the same way Reader's sourceLink does.

No manifest or generated file changes.

Verification

• pnpm check (no MDBASE_ENV): lint, typecheck and all tests pass. Reader: 390 vitest and 20 node tests. Extension: 169.
• MDBASE_ENV=production pnpm build passes (it includes manifest:validate), and the generated manifests are unchanged.
• manifest:verify passes with the real provisions.