fix(commerce-elastic-path): restore EPMultiLocationStock as deprecated (unblocks publish-hostless)

[field123]

@elasticpath/plasmic-ep-commerce-elastic-path is a published npm package of Elastic
Path commerce components for the Plasmic visual builder. It is also distributed as a
"hostless package" — a Plasmic project that carries the component definitions, refreshed
by a publish-hostless job.

0.5.0 removed EPMultiLocationStock. That makes publish-hostless fail outright:

[error] Hostless package removed components plasmic-commerce-ep-multi-location-stock

A component that disappears from a hostless package's registered set is treated as a
fatal error (server/code-components/code-components.ts asserts, commented "should be a
fatal error anyways"). The only repair path is Studio's client-side prompt to remap or
delete instances, which needs a human in a browser, so a headless publish cannot get past
it. 0.5.0 therefore cannot be published as a hostless bundle at all, and the npm
release is unusable for designers until this lands.

What this does

Restores the registration, marked deprecated:

• displayName: "EP Multi-Location Stock (deprecated)"
• description pointing at the replacement — EPStockProvider with EPLocationPicker
  and EPLocationField
• hideFromContentCreators: true

The component code and its three presentational helpers come back unchanged, so existing
projects using it keep rendering.

Why not just delete it

Components in a hostless package can be deprecated but not removed. Upstream does the
same rather than deleting: Table (deprecated) in antd5, Aria Heading (deprecated)
in react-aria — both hostless packages, both still fully registered.

Checked for alternatives first: no bundle migration has ever removed a code component,
and the error had never occurred in any previous publish-hostless run.

Also

• plasmicpkgs-dev pin and pnpm-lock.yaml bumped to 0.5.1 — the EP fork integrity test
  requires the pin to equal the workspace version, and --frozen-lockfile requires the
  lockfile to match
• 0.5.0's changelog entry keeps the removal on record, flagged as reverted here, since
  0.5.0 is already on npm

Follow-up, not in this PR

The deprecated component should not be insertable going forward. hideFromContentCreators
only applies in content-creator mode, and the per-item hidden flag for hostless packages
lives in DEVFLAGS.hostLessComponents, which has no entry for this package. Needs its own
change once the insert path is confirmed.