versions-up: auto-pin and PR after successful build

[lroolle]

Description

make versions-up && make versions-pin && make build-cloak is three commands where one should do. Worse, versions-pin re-fetches upstream after the build, so pins can drift from what was actually built (claude-code ships several times a day).

Type

• Enhancement

Details

Make make versions-up the whole team flow:

1. Resolve latest upstream versions once (add cloakbrowser wrapper, today only versions-pin fetches it)
2. Build core, main, rust, and cloak
3. On success, write versions.env from the exact resolved versions that were built — no second fetch, no race
4. Auto-commit and PR the pin bump to origin/main on chore/version-pins-refresh (temp worktree, user checkout untouched); PR=0 opts out, PR failure degrades to a warning with manual steps

make versions-pin and make build-cloak stay as standalone targets.

Related Files

• scripts/version-upgrade.sh
• scripts/update-version-pins.sh
• scripts/version-pins.sh
• scripts/versions-pr.sh (new)
• Makefile
• tests/version-upgrade.sh
• tests/versions-pr.sh (new)

Test Plan

• tests/version-upgrade.sh: 4 build invocations incl. cloak, pins written with resolved values, no builds/pins/PR on registry outage
• tests/versions-pr.sh: hermetic bare-repo origin + fake gh; branch pushed, commit content, pr create args; no-op when pins match upstream
• scripts/test-version-targets.sh still passes
• shellcheck clean