[baoyu-diagram] Declare conversion dependencies and align the SVG/PNG output contract

Reproduction

Verified against jimliu/baoyu-skills@6b7a2e417500561a5ecdd0b168332f4142584617, skill path skills/baoyu-diagram.

• SKILL.md says output is one standalone/self-contained SVG, but later requires generating an additional @2x PNG.
• The SVG example imports Google Fonts over the network despite the self-contained wording.
• The runtime fallback is npx -y bun, which may install/execute code from the network implicitly.
• scripts/main.ts dynamically imports sharp, but the skill directory has no package.json, lockfile, or declared sharp dependency.

A conversion smoke succeeded on one machine only because bun and a resolvable sharp were already present outside the skill. That does not give a clean install a reproducible dependency contract.

Expected

The skill should either:

1. be SVG-only and remove the PNG/dependency path; or
2. explicitly document SVG+PNG output, ship/pin the required runtime dependencies, and fail closed when they are absent without npx -y implicit installation.

The external-font policy should match the self-contained claim.

Suggested acceptance tests

• Run in a clean environment with no Bun or Sharp cache and no network.
• Assert the documented file set exactly matches generated outputs.
• Assert missing dependencies produce an actionable failure and never trigger an implicit install.
• Assert standalone output contains no undeclared external imports.