feat(sync): realign drifted packages to the highest version

[blendsdk]

Summary

Adds lockstep sync — the recovery path for a workspace whose packages have drifted out of lockstep. It scans every package plus the repository root, selects the highest version by numeric semver precedence (so 1.10.0 beats 1.9.0), and rewrites each package and its internal dependency ranges to that version, preserving range operators.

• Idempotent (already-uniform → no-op)
• Files-only: rewrites package.json only — no git commit, tag, or changelog
• --dry-run previews the change set without writing

Implementation notes

• Extracted the shared version-writing logic out of version() into a common applyVersion() helper (DRY).
• Added pure helpers semverCompare() / highestVersion().
• Root package.json participates in the max and is realigned even when all packages/ already agree (a lagging aggregator root is caught).
• Pre-release ordering uses a documented simplification (string compare of the pre-release tag on equal numeric cores).

Testing

• sync.spec.test.ts — 9 specification tests over real temp git fixtures (drift recovery, numeric precedence, operator preservation, root sync, no-op, dry-run, files-only/no-git, invalid semver).
• sync.impl.test.ts — 12 implementation tests for the precedence internals.
• Full suite: 104 tests passing; type-check clean.
• Drove the built CLI end-to-end against a drifted 1.9.0/1.10.0 fixture.

README and CLI help updated.

⚠️ Merging to master triggers the release workflow: a feat commit → minor bump (1.2.0 → 1.3.0), tag, and npm publish with provenance.