build: enable deno.lock; pin lodestar 1.44 / ssz 1.6.2

[KA-ROM]

Why

Every decker build / up on main fails today:

error: Uncaught (in promise) Error: List limit must be a positive integer
    at @lodestar/types/1.48.0/src/utils/rewards.ts:57:19

decker's npm deps are caret-ranged and resolved at run time (the generator imports them dynamically), so a new upstream release changes what runs. @lodestar/types 1.48 with @chainsafe/ssz 1.8 are mutually broken; nothing in the repo changed.

What

• deno.lock (new): pins the set that works. Key pins:

  dep	pinned
  @lodestar/types	1.44.0
  @chainsafe/ssz	1.6.2
  ethers	6.17.0
  @noble/curves / @noble/hashes	1.9.7 / 1.8.0
  @std/assert (e2e)	1.0.19

• deno.json (new): "lock": "deno.lock", and excludes lint's no-import-prefix rule. Having a deno.json at all turns that rule on, and inline npm:/jsr: specifiers are this repo's convention (67 sites).

Verify

• deno run -A cli.ts build rbuilder renders on this branch, fails on main.
• CI e2e passes here; it fails on every other open PR because their base is main.

Notes

• Bumping a dep = edit the specifier, run once, commit the lock. No behaviour change otherwise.
• Land this first; k8s: pod-unique port names and registry pull mode #12 → containers: config.image override for every container #13 → #14 are stacked on it for that reason.