feat(just): add `just deps` prerequisite checker

Part of #4709 ## Problem The build requires `just`, `podman`, `skopeo`, `cosign`, `yq`, `jq`, `pre-commit`, and `shellcheck`. Contributors discover missing tools only when a recipe fails mid-execution. This is the #1 blocker for new contributor onboarding. ## Proposal Add a `just deps` recipe that: 1. Checks for each required tool 2. Reports which are missing with install instructions 3. Distinguishes "required for local dev" vs "required for full build" ``` $ just deps ✓ podman 5.4.0 ✓ just 1.40.0 ✓ pre-commit 4.1.0 ✗ shellcheck — install with: dnf install ShellCheck ✓ skopeo 1.18.0 ✗ cosign — not needed for `just dev`, required for full build ``` ## Priority This is **P1** — must land before `just dev` (#4711). Contributors need to know what to install before they can build. ## Acceptance Criteria - [ ] `just deps` checks all tools needed for `just dev` and `just lint` - [ ] Clear pass/fail output with install hints - [ ] Distinguishes dev-only vs full-build dependencies - [ ] Non-zero exit code if dev-essential tools are missing - [ ] Includes minimum Just version check (for future import support)