fix(eth-block-tracker): promote @metamask/json-rpc-engine to a production dependency

[SnowingFox]

Summary

Fixes #6864

@metamask/json-rpc-engine is only declared as a devDependency of @metamask/eth-block-tracker, but PollingBlockTracker.ts imports the ContextConstraint and MiddlewareContext types from @metamask/json-rpc-engine/v2 with a type-only import. Those types appear in the published declaration files through PollingBlockTrackerOptions and the PollingBlockTracker class generic, so downstream consumers that type-check against the published package need @metamask/json-rpc-engine resolvable. Today the resolution happens to work because @metamask/json-rpc-engine is pulled in transitively through @metamask/eth-json-rpc-provider; declaring it only as a dev dependency makes the dependency graph correct by accident rather than by contract.

Changes

• packages/eth-block-tracker/package.json: promote @metamask/json-rpc-engine from devDependencies to dependencies. The range is unchanged (^10.5.0), matching the version the source imports and the version @metamask/eth-json-rpc-provider already requires.
• packages/eth-block-tracker/src/dependencies.test.ts: add a regression test asserting @metamask/json-rpc-engine is declared as a production dependency. It fails on main and passes with this change.
• packages/eth-block-tracker/CHANGELOG.md: add an [Unreleased] Fixed entry.

Test plan

cd packages/eth-block-tracker
NODE_OPTIONS=--experimental-vm-modules yarn exec jest src/dependencies.test.ts --coverage=false --silent=false

• Fails on main: Expected: not undefined, Received: undefined.
• Passes once @metamask/json-rpc-engine is declared in dependencies.

No yarn.lock change is needed: the lockfile records workspace dependency sets as a union, so moving a dependency between the dependencies/devDependencies sections does not alter the resolution metadata for @metamask/eth-block-tracker.

Notes

• The [Unreleased] changelog entry currently links to the issue; it can be updated to this PR's number once assigned.
• Separate, unrelated change: this author has an open PR in the same repo for a different subsystem (assets-controllers, NFT ownership restore).

---

Note

Low Risk
Dependency classification fix with no runtime behavior change; only ensures types already used in public declarations are correctly declared.

Overview
Promotes @metamask/json-rpc-engine from a devDependency to a production dependency so types that leak into PollingBlockTracker's published declarations resolve for consumers.

PollingBlockTracker type-only-imports ContextConstraint and MiddlewareContext, which appear in public .d.ts files via PollingBlockTrackerOptions and the class generic. Declaring the package only as a dev dependency left resolution dependent on a transitive install. Adds a regression test that asserts the production dependency is present.

^{Reviewed by Cursor Bugbot for commit 6bfe741. Bugbot is set up for automated code reviews on this repo. Configure here.}