docs: document vg lib lockfile pin and failure modes

[vibgrate-team]

Summary

### vg lib listed the subcommands and stopped there. A reader couldn't tell which version the page describes, which lockfiles are read, or what happens when the lookup fails. The README also showed vg lib express --fn middleware, a flag vg lib doesn't accept.

DOCS.md now covers:

• Lockfile pin. The version label is the lockfile pin, then the installed copy, then the declared range. --json reports the choice as source (lockfile, installed, declared or unknown).
• Which files are read, from the directory you run in (-C changes it): package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, Pipfile.lock, Cargo.lock, Gemfile.lock, composer.lock, packages.lock.json, Package.resolved, pubspec.lock and gradle.lockfile. The lookup skips go.sum (Go keeps the version declared in go.mod), pdm.lock, npm-shrinkwrap.json, bun.lock and Maven lockfiles.
• When a lookup fails: a missing lockfile entry, a lockfile and install that disagree (version_mismatch on --json), --offline or --local, and a failed catalog fetch. Each names the next action, and none prints credentials or lockfile contents.
• The only example is vg lib react, and the README matches it and links to the section.

Related issues

Closes #281

Checklist

• pnpm test passes
• pnpm lint is clean
• pnpm typecheck is clean
• Docs updated where behavior is described
• No proprietary or internal references
• Commits use Conventional Commits and are signed off

How to verify

Read DOCS.md and the README's vg lib section, then run:

pnpm test
pnpm lint
pnpm typecheck