Converge .deps pins on the JSR-consuming siblings; gate module identity on the resolved graph

[lann]

The follow-up flagged in #45's review discussion: with the sibling JSR migrations merged (webrtc#153, webcrypto#364, websocket#46), the .deps pins move to those revisions and the deltic graph converges on ONE embedder.

What this closes: before this bump, host-deltic's resolved graph carried TWO embedder copies — jsr ga67ee83 for the host + wasi-shims, and raw pre-58b2404 pulled in by the webcrypto sibling (its package-shaped deno.json maps @deltic/runtime/embedder for its own files; the entry import map never governed them). That's a live instanceof WitError identity split across the webcrypto boundary, latent on every error path — pre-dating #45, carried by the 48 raw-URL entries in host-deltic's lock that the review initially misread as cruft.

What changed

• scripts/setup.sh: WEBRTC_PIN → 5dc3d41, WEBCRYPTO_PIN → a0c924d, WEBSOCKET_PIN → a3b7fb1 (each repo's main, now consuming deltic from JSR at the same 0.1.0-pre.ga67ee83 this repo pins). TLS/IROH pins untouched (no deltic surface).
• Both deno.locks regenerated per the README procedure: host-deltic's drops all 48 raw-URL remote entries (nothing resolves them anymore); the experiments lock regenerates byte-identical.
• New gate, scripts/deltic-identity-gate.ts, wired into exam-deltic: the RESOLVED run-endpoint graph must carry exactly one @deltic/runtime version and zero raw-URL modules. Config greps cannot see this class (the split lived in a sibling's own config); only the graph can. Negative-tested: at the old pins it reports 48 raw-URL modules and fails; at the new pins it passes.
• host-deltic/README.md "Module identity" rewritten to describe the real resolution mechanics (nested package configs win for their files; identity rests on version agreement across every config, enforced by the two exam gates) instead of the disproven one-import-map story.

Gates (all green): just check; just build-components (endpoint recompiled against the bumped webcrypto/tls checkouts); just exam-deltic 5/5 with both gates inline — scenario 1 exercises the converged webcrypto ed25519 path through the single embedder; relay-ws browser-test from fresh dist (phase-2 echo p50 590 µs); blobs browser-test (phase-2 fetch 6.39 MiB/s); ping-demo build.sh; deno check across host-deltic, all three experiments, and the gate script.