fix(ci): re-land @faf/engine vendor tgz

Re-application of 5f9d9b5 (reverted in 6f29652). Without this, every
workflow fails at `npm ci` because package.json references a path
outside the repo (../faf-cli/...) that no CI runner has.

- vendor/faf-engine-3.1.0.tgz (25KB, copied from FAF/cli/faf-engine/)
- package.json: "@faf/engine" → file:vendor/faf-engine-3.1.0.tgz
- package-lock.json regenerated (also picks up flatted 3.4.2 override)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Wolfe-Jam

package-lock.json

@@ -57,6 +57,6 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@faf/engine": "file:../faf-cli/faf-engine/faf-engine-1.0.0.tgz"
+    "@faf/engine": "file:vendor/faf-engine-3.1.0.tgz"
   }
 }