Add frontend Volto distribution management to deps commands

[sneridagh]

Summary

Adds two companion features to the deps command group for projects built on a Volto distribution. Both are keyed on the custom volto_version field that a distribution package publishes — so plain Volto and non-distribution base packages are unaffected, with no opt-in flag required.

1. deps upgrade frontend — enforce distribution dependencies

When the frontend base package is a distribution (detected automatically via volto_version), upgrading it now also:

• fetches the distribution's enforced dependencies and volto_version from the npm registry for the new version;
• writes them to frontend/distribution.json (consumed by the project's .pnpmfile.cjs hook to pin those versions across the whole pnpm workspace) — before make frontend-install runs;
• aligns the @plone/volto tag in mrs.developer.json to the distribution's volto_version.

This replaces a per-project upgrade-distribution.js script with first-class repoplone support, fetching npm metadata directly (no pnpm view shell-out).

2. deps stamp-volto-version — record the Volto version when releasing a distribution

New command that reads the @plone/volto tag from mrs.developer.json and writes it verbatim into the frontend package's package.json volto_version field. Meant to be wired into a distribution's release-it after:bump hook, so the published package advertises the Volto core it targets — which is exactly what feature #1 reads on the consumer side. The two halves form a closed producer/consumer loop.

The command is cwd-independent inside the repo (it locates repository.toml by walking up), so it works from the package directory where release-it runs.

Tests

• New tests/utils/dependencies/test_utils_distribution.py (unit coverage for detection, sync, stamping, and the no-volto_version skip path).
• New command tests in tests/commands/deps/test_deps.py for both the distribution upgrade and the stamp command.
• Existing parametrized upgrade tests updated (the shared in_patch_sync fixture now also stubs sync_distribution, since the frontend upgrade path reaches the npm registry unconditionally).
• README section + two news fragments added.

All deps/dependencies suites pass (124), ruff clean. Verified live (byte-identical output) against the intra.kitconcept.com and kitconcept-website repos.