chore(release): keep bun.lock in step with the version commit

The version commit stages the whole working tree, so the lockfile has
to carry the bumped workspace versions before it runs. A pre-ordered
plugin refreshes bun.lock from the manifests and reads it back; a
workspace whose recorded version is not the manifest's fails the
release. Bun's frozen install does not treat a workspace version as a
lockfile change, which is why the readback is explicit.