feat(vagrant): pickup/drop glue + lib-core.inventory-list dep

- Add lib-core.inventory-list v0.1.0 to manifest deps; bump module
  version 0.7.1 -> 0.7.2
- Import inventory = require("lib-core.inventory-list") in init.lua
- Add Item-Template-Convention comment block after vagrant_player
  template: documents stack_mode/tags/sprite/position contract that
  B.4 (rock) and B.5 (backpack-as-container) will fulfill
- Add register_pickup(item) factory: reads item position, registers
  interaction trigger; callback calls inventory.add + unregisters
  trigger on pickup
- Bind "drop" action to Q; drop handler in M.update pops last item
  from backpack via inventory.remove (renderable tag restored by
  library), repositions item at player pos +30px, re-registers pickup
- Update README Controls section: document E (pickup) and Q (drop)
  with note that end-to-end use requires B.4 + B.5

manifest.module

@@ -1,6 +1,6 @@
 {
     "id": "vagrant-skeleton",
-    "version": "0.7.1",
+    "version": "0.7.2",
     "kind": "module",
     "api": "^0.1",
     "ci_frames": 60,
@@ -20,6 +20,7 @@
         {"id": "lib-core.maps","version":"0.5.7"},
         {"id": "lib-core.puppet",                 "version": "0.5.0"},
         {"id": "lib-core.interaction",            "version": "0.1.0"},
+        {"id": "lib-core.inventory-list",         "version": "0.1.0"},
         {"id": "lib-asset.prototype-subterrain",  "version": "0.2.0"},
         {"id": "lib-asset.prototype-blob-geom",   "version": "0.1.0"}
     ]