build(release): pin pnpm-release-management to fd4ce356 so pr commits as github-actions[bot]

[systemfsoftware-maker]

Summary

Bumps flake.lock's pnpm-release-management input from bb3b8b5 to fd4ce356 (pnpm-release-management #39). Release run 37721948068 failed at github-release-management pr because the runner has no git identity; with this rev, pr commits as github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> passed with -c, and a failed git command prints the command and git's stderr. The new rev needs nothing else in this repo.

Evidence (throwaway clone of this branch, discarded)

Every command ran like the version job runs it: a fresh clone with no pnpm install (so no husky core.hooksPath), nix develop --ignore-environment, empty HOME and XDG_CONFIG_HOME, GIT_CONFIG_NOSYSTEM=1, no GIT_AUTHOR_*/GIT_COMMITTER_*/EMAIL, and only the runner's git added to PATH. In that shell git var GIT_COMMITTER_IDENT fails with fatal: unable to auto-detect email address.

• a. version-management bump: exit 0. @systemfsoftware/stryker-js goes to 18.0.0; 35 modified, 20 intents deleted, 1 new test/e2e-core/CHANGELOG.md; 18 CHANGELOG.md files gain a section; nothing parked.
• b. pnpm guard:projects: exit 0, "17 publishable package(s) each carry exactly one section for their version, and no section is parked".
• c. github-release-management pr against a local bare remote (via url.<bare>.pushInsteadOf in the clone's own .git/config) and a fake GitHub API (GITHUB_API_URL), with an untracked .release/captured.json and a result symlink in the checkout: exit 0, created release PR #1. The fake API saw the lookup, a create titled chore(release): version packages, and the release label. On the bare remote, changeset-release/main:

  author:    github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
  committer: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
  subject:   chore(release): version packages
  1 A, 20 D, 35 M
  

  Its name-status equals bump's changes exactly (diff empty); no .release/ or result path; .release/captured.json is still untracked afterwards.
• d. github-release-management release --dry-run in the same shell: exit 0, dry run: 17 release(s), including @systemfsoftware/stryker-js@v18.0.0.
• e. CI on the head: see below.

Nothing was run with stryker.

[kiro-systemf]

Verified: 11/11 green on 5c2addf; flake.lock only; in a runner-like env with no identity, the release commit is authored and committed by github-actions[bot] and holds exactly the bump's tree; the release dry-run lists 17 releases.