The timeline of December 1997 to December 1998 is incorrect. In his diversion paperwork, which was in March 1998 Dylan wrote that he had worked at Blackjack and Alberstons, and the longest he worked at a job was 3 months. He got the job at Albertson's shortly after the van break in and had quit before the diversion paperwork was completed, since it hadn't been 3 months that means that he only worked at Blackjack for 3 months prior to March 1998. On December 21st he reported to his diversion officer that he was back at Blackjack Pizza. The diversion appointment before this was on December 1st. Meaning that he was rehired during this 3 week window.
According to Duran's statement to police he had been hired at Blackjack in January or February of 1998. It's heavily implied that Duran met Dylan while working at Blackjack. They also did not attend Columbine at the same time therefore couldn't have met at school prior to Blackjack. He also said that he had been approached by Eric and Dylan a few times to purchase guns for them but he told them he wouldn't buy them guns because he didn't want his name on any paperwork.
Both Chris Morris and Robert Perry were the same age as Dylan and were part of the class of 1999, not a year ahead and Joe Stair would have been 17 in November 1997 and would have been unable to legally purchase a firearm.
This is an interesting question and I wish I could help more, but I don't really have any ideas on who it actually was.