test_version_sync.py does not guard emrg/gui/package-lock.json (8th version source) #1065

Summary

tests/test_version_sync.py guards 7 of the 8 release version sources, but emrg/gui/package-lock.json is not covered — the release convention (see PR #1064, v0.2.87 bump) treats it as an 8th source (root version + packages[""].version, 2 spots), yet no test fails if a future bump misses it.

Context

• PR emrg: 补 emrg/gui/package.json v0.2.3 版本同步（#407 遗漏） #408 lesson: a missed version source caused a broken release (bump then delete tag + rebuild). The test was added to prevent exactly that class of accident.
• The test currently checks: emrg/__init__.py (base), pyproject.toml, emrg/gui/package.json, uv.lock, and 3 shell fallbacks (make-installer.sh, build-runtime.sh, make-run-installer.sh).
• PR emrg: bump version to v0.2.87 (release: #1061-#1063 — hover flicker fix, tiptap Stage 1+2) #1064 bumped emrg/gui/package-lock.json (root + packages[""]) as part of the 8-source convention — so it is now officially a version source, but unguarded.

Suggested fix (small, hermetic)

Add a helper in tests/test_version_sync.py mirroring _gui_package_version():

def _gui_package_lock_version() -> str:
    """gui package-lock.json 的根 version（npm 由 package.json 生成，须同步）。"""
    content = (REPO_ROOT / "emrg" / "gui" / "package-lock.json").read_text(encoding="utf-8")
    m = re.search(r'"version"\s*:\s*"([^"]+)"', content)
    assert m, "emrg/gui/package-lock.json 中找不到根 version"
    return m.group(1)

…and assert it equals _base_version() in test_all_version_sources_consistent(). The first "version" match in package-lock.json is the root field (lockfileVersion does not match the quoted regex); the packages[""] copy is npm-generated and stays in sync.

Impact

Prevents a future v0.2.x bump from silently leaving package-lock.json at the old version (the #408 accident class). Pure logic test, no platform/network dependency — runs on all CI platforms.