Wire rush-reporter package dependencies

[Sean Larkin (TheLarkInn)]

Summary

• add @rushstack/rush-reporter as a workspace dependency of @microsoft/rush-lib and @microsoft/rush
• update the default-subspace PNPM importers and approved-package metadata through the Rush update workflow
• add a focused package-boundary test that keeps the reporter independent from rush-lib

Validation

• rush build --to @microsoft/rush --verbose
• rush test --only @rushstack/rush-reporter --verbose (293 tests passed)
• rush check
• rush change --verify --no-fetch

Non-goals

• no bootstrap-envelope encoder or protocol-major generation (owned by R1B)
• no runtime integration, reporter opt-in, or default output changes

Part of #5974

[Sean Larkin (TheLarkInn)]

All required CI is green and independent integration review is complete. This PR is now the first gate for the validated reporter stack: #5986 → #5987 → #5989 → #5988 → #5991 → #5992 → #5996 → #5997, with #5993/#6000/#5999/#5998 branching from the appropriate tips.

The slice remains limited to package dependency/lockfile/boundary wiring and preserves runtime/default output behavior. Squash auto-merge is enabled; requesting maintainer approval so the fleet can begin sequential retargeting and full-CI validation of each child.

[Sean Larkin (TheLarkInn)]

Combined deep review of current head 2b89273bbb.

No critical, high, or medium actionable findings. No useful low follow-ons.

[Sean Larkin (TheLarkInn)]

Ian Clanton-Thuon (@iclanton) David Michon (@dmichon-msft) Maintainer review is now the only gate on this root stack. #5985 is clean with full CI green and auto-merge enabled. Every descendant current head has completed repeated deep review with no actionable issue above low. Could one of you review the root so sequential retargeting can begin?

The independent privacy root #5990 is also full-CI green, low-only, and auto-merge enabled.