Pinned importmap skips elision pruning (pinned != unpinned)

[vivek7405]

Problem

A committed vendor pin is served verbatim and skips the elision-aware pruning the live-resolve path applies, so a pinned app and an unpinned app serve different importmaps for the same source.

resolveVendorImports (packages/server/src/vendor.js ~1317) short-circuits when a pin file exists and returns file.imports as-is, never running the bare-import scan that the unpinned path uses (the scan excludes elided components). So a vendor package whose only importer is a display-only, elided component (e.g. dayjs via the blog vendor-badge) is pruned from the importmap when resolved live, but kept when pinned.

This surfaced as the #170 elision e2e ("vendor package used only by a display-only component is never fetched") failing once the blog was pinned (#190): the test asserts the served importmap has no dayjs entry, but the pin reintroduced it. Reverting the blog pin (#196) works around it, but the framework behaviour should be identical whether or not a package is pinned.

Design / approach

The served vendor set should always be {pin-or-live entries} INTERSECT {specifiers reachable from non-elided modules}, regardless of source. Today only the live path applies that intersection (via the elision-aware scanBareImports exclusion before resolving).

Apply the same intersection to the pinned path, in ensureReady AFTER elision is computed (not at boot, so runtime-first boot stays intact: the pin is still applied verbatim at boot for a stable build id, then refined to the pruned set once warm). Handle subpath specifiers (prune dayjs/plugin/x when dayjs is unreachable) and leave @webjsdev/core/* framework entries untouched. The build id must stay stable across the refine (no warmup drift).

Acceptance criteria

• With a dayjs pin present, the blog serves an importmap with NO dayjs entry (pruned because its only importer is elided), so Add e2e network probes for vendor-never-fetched + inert-route zero-JS elision #170 passes pinned exactly as unpinned.
• An unpinned app is unchanged.
• A pinned package that IS reachable from a non-elided module stays in the importmap.
• Runtime-first boot preserved (no whole-app scan at boot; the prune runs in ensureReady).
• Build-id stability preserved (no destructive hard-reload from the warm-time refine).
• Tests cover pinned-with-elided-dep pruning; docs (server AGENTS.md invariant 7) updated to drop the "a committed pin is served as-is / never pruned" caveat.