bun pm pack resolves workspace:* from bun.lock, and bun install does not
refresh the lockfile's workspace "version" fields on a version bump — so
the v0.1.4 tarballs shipped pinning sibling @fuguejs/* deps at 0.1.0,
giving consumers nested duplicate framework copies (broken module
augmentation, dual branded types). Bump the lockfile workspace entries
alongside the package versions, and add a release gate that inspects
each packed tarball and refuses to publish when any @fuguejs/* pin
differs from the release version.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>