fix(release): finalize v0.4.4 versions deterministically

[edgyarmati]

Summary

Completes the repository-side finalization of the already-published GedCode v0.4.4 release and fixes the lockfile synchronization bug that caused the final job in release run 33156001321 to fail after publication succeeded.

The v0.4.4 tag, GitHub release assets, and signed Sparkle feed were published successfully. Only the post-publication package-version commit failed.

Failure observed

The finalizer updated the four releasable package manifests to 0.4.4, then ran:

bun install --lockfile-only --ignore-scripts

Bun left the workspaces.*.version fields in bun.lock at 0.4.3, so the release consistency check failed and no finalization commit reached main. Regenerating the complete lockfile is not an acceptable workaround: it rewrites hundreds of dependency lines and varies with the runner platform.

Changes

• Record the published 0.4.4 version in the server, desktop, web, and contracts package manifests.
• Update only the matching four bun.lock workspace version fields to 0.4.4; no dependency resolution changes are included.
• Extend update-release-package-versions.ts to keep package manifests and Bun workspace metadata synchronized as one deterministic operation.
• Preserve the delayed-finalization protection: if main already contains a consistently newer version, that newer version remains authoritative and its lock metadata is repaired instead of being downgraded.
• Return changed: true when package manifests already match but lock metadata needs repair.
• Include bun.lock in the workflow diff check so lock-only repairs are committed.
• Remove platform-dependent lockfile regeneration from stable finalization.
• Add regression coverage for full version updates, lock-only drift repair, no-op behavior, and preserve-newer behavior.
• Document the future-finalization correction under Unreleased; it is intentionally not added to the already-tagged v0.4.4 release notes.

Repository state change

Before this PR, the public release was v0.4.4 while main still recorded v0.4.3, and future release finalization would repeat the same failure.

After this PR, package manifests and Bun workspace metadata agree on the published v0.4.4 version. Future stable finalization changes only the intended version fields and can safely commit either a full version advance or a lock-only repair.

Verification

• bun fmt
• bun lint (passes; existing non-blocking warnings remain)
• bun run --filter=@t3tools/scripts typecheck
• bun run --filter=@t3tools/scripts test -- update-release-package-versions.test.ts — 10 tests passed
• bun run release:smoke
• bun run release:versions:check — manifests and lock agree on 0.4.4
• git diff --check
• Confirmed the bun.lock diff is exactly four one-line workspace version replacements and contains no dependency churn.

Published release context

Release workflow run 33156001321 completed preflight, macOS/Linux/Windows builds, signed Sparkle feed generation, and GitHub publication successfully. This PR does not rebuild, retag, or alter released binaries; it only reconciles main and repairs future finalization.