ci: harden releases and lockfiles

[victor0602]

Summary

• synchronize Bun and npm lockfiles and update Undici to the patched 6.x release
• keep build-only bun-plugin-dts in development dependencies
• use frozen installs and pin third-party Actions to verified commit SHAs
• run typecheck, lint, tests, build, package-content checks, and Node 18/current-LTS smoke tests before publishing
• publish the exact verified tarball before creating the GitHub release
• add workflow permissions, concurrency controls, and execution timeouts

Validation

• bun install --frozen-lockfile
• npm ci --ignore-scripts
• bun run typecheck && bun run lint && bun test && bun run build (449 passed)
• npm package-content and CLI/SDK smoke checks
• npm audit --registry=https://registry.npmjs.org --audit-level=high (0 vulnerabilities)
• workflow YAML parsing and Action tag/SHA verification

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[NianJiuZst]

No blocking findings on the current head. The two lockfiles install reproducibly, package contents and Node entry points are checked before publish, and every pinned Action SHA matches the stated upstream tag; I recommend merging it.

Verified locally: frozen Bun install, typecheck, lint (one pre-existing warning), full suite (449/449), build, npm package contents, npm ci --ignore-scripts, and zero npm audit findings. GitHub checks are green. I did not execute the tag-triggered npm publish/release path.