refactor(dlx): drop the force option and range detection

[Oskar Haarklou Veileborg (BarrensZeppelin)]

Coana was the only caller of spawnDlx that passed force: true, and the
only one with a version range. cdxgen and synp are pinned and launched
with silent: true, so neither code path runs any more.

Part of REA-875.

Expected reviewer effort: Stamp

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

---

Note

Low Risk
Internal DLX helper cleanup with no remaining force callers; pinned cdxgen/synp paths unchanged aside from removed dead options.

Overview
Simplifies spawnDlx by removing cache-bypass and version-range behavior that only Coana needed.

DlxOptions no longer includes force. spawnDlx no longer detects semver ranges to auto-enable force or default silent to true for unpinned versions—silent now defaults to false unless callers opt in (cdxgen/synp helpers still pass silent: true). For pnpm, the npm_config_dlx_cache_max_age env override is gone; npm_config_ignore_pnpmfile remains. For npm/npx, --force is no longer added. Tests drop coverage for force, cache bypass, and unpinned silent defaults.

^{Reviewed by Cursor Bugbot for commit bafbd8e. Configure here.}