Make CI able to catch a missing runtime dependency

[Vasanthdev2004]

Closes #21.

#20 fixed a crash on first run: cli.py imports click, typer 0.26.8 dropped click from its dependencies, and a runtime-only install had no supplier for it.

Every CI job stayed green the whole time, because every job installs .[dev] and black depends on click>=8.0.0. The test suite, ruff, mypy and three adversarial review passes all missed it. A user found it on the first command they typed.

Three changes so this class of bug fails here instead.

packaging/check_deps.py

Compares third-party imports under src/ against project.dependencies. It checks the declaration, not the installed environment, so it catches:

• imports a dev tool happens to satisfy
• imports that are unreachable at module scope

Verified against the real bug by reproducing the pre-#20 state:

=== click undeclared ===
exit: 1 (want 1)
  click  (add 'click' to project.dependencies)
      src/game_save_genie/cli.py:13

=== restored ===
exit: 0 (want 0)

Guard code that has never been shown to fire is just decoration, so this one has.

runtime-deps CI job

Installs with a plain pip install . (no [dev]), imports every module in the package, and runs the entry point. That is the environment a user actually gets, and no existing job reproduced it.

import click moves to module scope

As a function-local import it failed halfway through the wizard, after the menu had already printed, and no import sweep could reach it. At module scope it fails at import time: louder, and detectable by the job above.

Also

check_deps.py reads pyproject as utf-8-sig. With plain utf-8, a BOM left by an editor makes it die with a TOML parse error instead of answering the question. Found while testing the failure path, which is the sort of thing you only hit by actually running the negative case.

Testing

ruff clean, mypy clean, 173 tests pass, import game_save_genie.cli resolves click at module scope.

Not addressed here, from #21: fork PRs sit at action_required and get no CI signal. #20 was merged after local verification. Still worth a policy decision.