Declare tsx where the fuzz runner actually lives

The differential-fuzz CI job failed with "tsx: not found" — the TypeScript
side of the fuzzer never ran at all, so the job was reporting on Python
output alone.

`tsx` was a devDependency of @seedpass/cli only, while the fuzz runner lives
in packages/core and is invoked with cwd there. It worked locally because
core's node_modules/.bin had a stale tsx from an earlier install, and could
never work from a clean `pnpm install --frozen-lockfile`. Precisely the class
of bug that only CI can see, on the first run after wiring these checks up.

Declared in @seedpass/core rather than papering over it with a path or a
--filter, so the invocation is correct by construction. Verified by removing
core's node_modules, reinstalling frozen, and running CI's own seed 1 end to
end: 1050 cases, no divergences.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN

js/packages/core/package.json

@@ -25,6 +25,7 @@
     "@seedpass/test-vectors": "workspace:*",
     "@types/ws": "^8.18.1",
     "jsdom": "^30.0.1",
+    "tsx": "^4.20.0",
     "typescript": "^5.7.0",
     "vitest": "^3.0.0",
     "ws": "^8.21.3"