build(release): verify packed workspace dep versions before publishing

bun pm pack / bun publish rewrite workspace:* deps from bun.lock, not
package.json, so a version bump without a lock refresh publishes
manifests depending on old (possibly never-published) versions while the
registry check and per-package abort all pass. Pack every package and
diff manifest @droveragent/* dep versions against workspace package.json
versions before the publish loop — npm versions are immutable, so a bad
publish burns the version number.

Verified: passes on the synced lock; reverting one lock entry to 0.0.2
aborts with 'stale workspace deps in packed @droveragent/sandbox'.