fix(release): ship the napi-rs keyring as the CLI package's runtime dependency

esbuild cannot bundle @napi-rs/keyring's native .node binding, so the
deterministic-build job failed bundling the CLI. Mark it external and
declare it (exact-pinned from the CLI workspace) as the generated
package's single runtime dependency; npm resolves the platform binding at
install time, matching how the Homebrew formula installs the tarball.

Co-authored-by: Cursor <cursoragent@cursor.com>