fix: add picomatch as explicit devDependency

Addresses Cursor BugBot review: picomatch was only available as a
transitive dependency via tinyglobby. Adding it explicitly prevents
breakage if tinyglobby ever changes its dependency tree.

Author: BYK

bun.lock

@@ -31,6 +31,7 @@
     "marked": "^15",
     "openai": "^6.22.0",
     "p-limit": "^7.2.0",
+    "picomatch": "^4.0.3",
     "pretty-ms": "^9.3.0",
     "qrcode-terminal": "^0.12.0",
     "semver": "^7.7.3",