fix(release): pin optionalDependencies to bootstrap version in committed source

CI was failing because apps/cli/package.json declared optionalDependencies
at 0.16.0 but only 0.0.0-bootstrap exists on npm for those packages. The
lockfile couldn't resolve, and `pnpm install --frozen-lockfile` rejected
the working tree.

Pin optionalDependencies to 0.0.0-bootstrap in the committed source so the
lockfile resolves cleanly. The release workflow now bumps them to the real
version inside publish-npm.sh, just before publishing main kandev — at
which point the matching @kdlbs/runtime-*@VERSION tarballs have already
been published earlier in the same step. This avoids the chicken-and-egg
where the prepare job tried to bump optional deps to a version that didn't
yet exist on npm.

Workflow changes:
- prepare job: only bumps the main package version, not optional deps.
- publish-npm.sh: rewrites optionalDependencies to $VERSION right before
  the main `npm publish`, after the 5 runtime packages have been published.

The published kandev@X.Y.Z still has its optionalDependencies pinned to
matching @kdlbs/runtime-*@X.Y.Z. Only the local source uses the bootstrap
pin for development convenience.

.github/workflows/release.yml

@@ -139,23 +139,16 @@ jobs:
             exit 1
           fi
 
-      - name: Bump version + optionalDependencies
+      - name: Bump version
         env:
           NEXT: ${{ steps.compute.outputs.version }}
         run: |
           set -euo pipefail
+          # Bump only the main version. optionalDependencies stay pinned to
+          # 0.0.0-bootstrap in the committed source — the publish-npm step
+          # rewrites them to the real version in-flight before publishing,
+          # once the matching @kdlbs/runtime-* tarballs actually exist on npm.
           (cd apps/cli && npm version --no-git-tag-version "$NEXT")
-          node -e "
-            const fs = require('fs');
-            const path = 'apps/cli/package.json';
-            const pkg = JSON.parse(fs.readFileSync(path, 'utf8'));
-            if (pkg.optionalDependencies) {
-              for (const k of Object.keys(pkg.optionalDependencies)) {
-                pkg.optionalDependencies[k] = '$NEXT';
-              }
-            }
-            fs.writeFileSync(path, JSON.stringify(pkg, null, 2) + '\n');
-          "
           pnpm -C apps install --no-frozen-lockfile
 
       - name: Generate CHANGELOG