ci: harden releases and lockfiles

[victor0602]

Summary

• synchronize Bun and npm lockfiles and update Undici to the patched 6.x release
• keep build-only bun-plugin-dts in development dependencies
• use frozen installs and pin third-party Actions to verified commit SHAs
• run typecheck, lint, tests, build, package-content checks, and Node 18/current-LTS smoke tests before publishing
• publish the exact verified tarball before creating the GitHub release
• add workflow permissions, concurrency controls, and execution timeouts

Validation

• bun install --frozen-lockfile
• npm ci --ignore-scripts
• bun run typecheck && bun run lint && bun test && bun run build (449 passed)
• npm package-content and CLI/SDK smoke checks
• npm audit --registry=https://registry.npmjs.org --audit-level=high (0 vulnerabilities)
• workflow YAML parsing and Action tag/SHA verification

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}