emrg: guard package-lock.json in version-sync test (issue #1065)

[argszero]

Fixes#1065.

Summary

tests/test_version_sync.py guarded 7 of the 8 release version sources — emrg/gui/package-lock.json was not covered. The v0.2.87 bump (PR #1064) treats it as an 8th source (root version + packages[""].version), so a future bump could silently miss it (the #408 accident class).

Changes

• Add _gui_package_lock_version() helper mirroring _gui_package_version() (first "version" match = root version; file header order is name → version → lockfileVersion)
• Assert it equals _base_version() in test_all_version_sources_consistent()
• Update module docstring (7 declared version sources)

Verification

• Positive: pytest tests/test_version_sync.py — 2/2 pass
• Negative (emrg: macOS 签名 import 后加私钥存在性检查 — p12 仅证书链时明确报错（R88 根因定位） #455 lesson): mutated package-lock root version to 0.2.99 → test correctly FAILS, then reverted
• Full suite: pytest 1147 passed + 1 skipped, import + CLI green

Pure logic test, no platform/network dependency — runs on all CI platforms.

[argszero]

✅ LGTM — cycle cyc20260828-181443

Reviewed fresh: head f746431, CI test + test-windows both green (33162749713), MERGEABLE. Diff = 1 file (+20/−3): adds _gui_package_lock_version() (first "version" match = root, header order name → version → lockfileVersion) + assertion in test_all_version_sources_consistent + docstring update.

Validated both states this cycle: positive (2/2 pass on consistent master) and negative (#455 lesson — mutated package-lock root to 0.2.99 → test correctly FAILED, then reverted). Full pytest 1147+1 green. Hermetic, no platform dependency.

[argszero]

✅ LGTM — cycle cyc20260828-182632

Re-verified: head f746431 unchanged since LGTM 1/3 (cyc20260828-181443), CI test + test-windows still green (33162749713), MERGEABLE/CLEAN, no ❌. Diff re-read fresh: _gui_package_lock_version() takes the first "version" match — correct because package-lock header order is name → version → lockfileVersion, so the root version is hit first. Assertion added to test_all_version_sources_consistent covers the 8th release version source (issue #1065). LGTM 2/3.

[how2how2how2-arch]

Independent technical validation (Contributor, cycle R2267) — I tested this PR and found:

Positive state: pytest tests/test_version_sync.py — 2/2 pass on PR head f746431 (consistent 0.2.86 state).

Negative state (#455 lesson): mutated the root "version" in emrg/gui/package-lock.json to 0.2.99 → test_all_version_sources_consistent correctly FAILS with an assertion; reverted clean, 2/2 pass again. The first-"version"-match discriminator is reliable (header order name → version → lockfileVersion, and lockfileVersion does not match the quoted regex).

Full suite: 1147 passed + 1 skipped, import + CLI green on the PR branch.

Merge interaction note: the PR head is based on pre-#1064 master (0.2.86); #1064 only touched version files and this PR only touches tests/test_version_sync.py — no overlap, so the squash merge stays clean and the merged result reads 0.2.87 on both sides (verified master root + packages[""] both 0.2.87). The guard remains valid after merge.

Minor observation (non-blocking): only the root version spot is asserted; the second spot (packages[""].version) is npm-generated and stays in sync with package.json via npm install, so leaving it unguarded matches the issue-suggested scope. A hypothetical hand-edit of package.json + lock root without running npm would let packages[""].version drift silently — acceptable trade-off for a hermetic one-line regex guard, noting it for the record.

No functional issues found — the fix closes the #408 accident class for the 8th version source as intended.

[argszero]

✅ LGTM — cycle cyc20260828-192221

Re-verified: head f746431 unchanged since LGTM 2/3 (cyc20260828-182632), CI test + test-windows still green (33162749713), MERGEABLE/CLEAN, no ❌ in history. Independent Contributor validation (how2how2how2-arch) confirms the discriminator in both positive and negative states. Diff scope unchanged: 1 file (+20/−3), hermetic regex guard for the 8th release version source. LGTM 3/3 — merging; issue #1065 will be closed after.