fix(release): keep Pantry workspace lock versions atomic

Problem

Recursive Bumpx releases update workspace manifests but leave pantry.lock workspace version fields untouched. Pantry is tagged at v0.10.45 while its lock still reports packages/ts-pantry v0.10.30; Craft v0.0.46 still reports workspace v0.0.39. This violates lockfile provenance and makes a release tag internally inconsistent.

Required contract

• Detect pantry.lock at the recursive workspace root.
• Update only workspace entries whose manifest versions are part of the release.
• Preserve root entries without a version and all resolved package metadata.
• Fail closed on malformed lock JSON instead of tagging partial state.
• Cover full recursive, selective, dry-run, and unrelated-entry behavior.
• Include the lock update in the same release commit and tag.

Downstream evidence: pantry-pm/pantry#216 and home-lang/craft#15.

Implemented by 1cba9f7 and verified downstream with Bumpx v0.2.10. Pantry v0.10.47 and Craft v0.0.47 both created release tags whose pantry.lock workspace versions exactly match every released workspace manifest. Pantry tag: https://github.com/pantry-pm/pantry/tree/v0.10.47 Craft tag: https://github.com/home-lang/craft/tree/v0.0.47