feat: regenerate lockfile via npm i --package-lock-only in release skill

[j4rviscmd]

Summary

Replaces the brittle sed-based package-lock.json version replacement in the release skill with npm i --package-lock-only, and adds a mandatory diff verification step. Also syncs stale lockfile versions missed in recent releases.

Changes

Release skill improvements (.claude/skills/release/SKILL.md)

• Step 4: Replaced sed-based package-lock.json / extensions/copilot/package-lock.json version string replacement with npm i --package-lock-only (root & extensions/copilot/)
• Step 4: Added mandatory git diff verification after lockfile regeneration to catch unexpected dependency changes (e.g. indirect dependency updates)
• Step 0 task 4 description: Updated to reflect the new regeneration method and diff verification step
• Guardrails: Added a rule prohibiting sed-based lockfile editing (collision risk with other dependency version strings, integrity risk)
• Spec table: Updated package-lock.json rows to note npm i --package-lock-only regeneration

Stale lockfile sync

• Synced package-lock.json and extensions/copilot/package-lock.json versions (1.122.0-coderm.0.26.0 → 1.122.0-coderm.0.28.0) that were missed in the last 2 releases (0.27.0, 0.28.0) due to the brittle sed approach
• Confirmed via git diff that only version references changed (no unexpected dependency updates)

Why

The previous sed approach replaces the version string globally, which:

• Risks colliding with other dependency version strings in the lockfile
• Can silently fail on Windows/GNU sed (sed -i '' is BSD/macOS-only)
• Actually caused version update misses in recent releases (lockfile stayed at 0.26.0 while package.json advanced to 0.28.0)

npm i --package-lock-only regenerates the lockfile safely without touching node_modules, and picks up package.json#version changes correctly.

Verification

• npm i --package-lock-only on root updates only version (2 places)
• npm i --package-lock-only on extensions/copilot/ updates only engines.vscode (1 place)
• No unexpected dependency changes in the diff