bun pm pack reads workspace versions from bun.lock, not package.json

bun pm pack rewrites workspace:* specifiers to concrete versions at pack time, reading them from bun.lock — NOT from the workspace package.json. If craft bumps package.json but leaves bun.lock stale, published tarballs point at old versions (ETARGET on install). Fix in NpmTarget.patchBunLock (src/targets/npm.ts): regex-patch bun.lock per workspace path-key. CRITICAL regex gotcha: use [^{}]*? (not [\s\S]*?) to bound the match to the workspace's own block — [\s\S]*? walks past a versionless workspace's closing } and silently rewrites the NEXT workspace's version. Normalize \ → / for Windows; escape regex chars (reuse escapeRegex from src/utils/filters.ts, don't duplicate). Only call when isWorkspace is true — otherwise non-workspace bun repos get a spurious 'lockfile out of sync' warning. Idempotent; uses safeFs.writeFileSync.