fix(deps): cascade composition 0.4.0 + crafting 0.5.0 pins

Phase J (2026-08-03) bumped lib-core.composition 0.3.0->0.4.0 and
lib-core.crafting 0.3.0->0.5.0, but only vagrant-skeleton and
lib-core.crafting themselves were updated. Dependent manifests kept the
old pins, so dep-fetcher saw disagreeing pins on the same lib and
refused to start both spine-prototype (ENGINE_ERR_LIB_DEP_MISSING,
rc=19) and vagrant-skeleton ("dep check failed", conflict on
lib-core.composition + lib-core.crafting).

Unify all pins on the on-disk versions. No code changes required:
composition 0.4.0 is purely additive (the quality/condition loud-error
was removed; no signature changed), and crafting-display only consumes
crafting.can_craft + crafting.list_recipes, both still present, and
never referenced the `form` field retired by ADR-0055.

README "Requires:" lines synced to match the manifests (Gate 3).

milestone-check.sh: GREEN (build, ctest, smoke, devwrap-ci,
test-all-modules + anomaly scan). vagrant-skeleton headless run clean
at 60 CI frames.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

manifest.module

@@ -11,7 +11,7 @@
     "deps": [
         {"id":"lib-core.maps","version":"0.5.7"},
         {"id":"lib-core.render","version":"0.3.0"},
-        {"id":"lib-core.composition","version":"0.3.0"},
+        {"id":"lib-core.composition","version":"0.4.0"},
         {"id":"lib-core.camera","version":"0.3.0"},
         {"id":"lib-core.input","version":"0.4.0"},
         {"id":"lib-core.panel","version":"0.4.0"},