fix: bump package.json version on semantic release

[Peyton-Spencer]

Summary

• Add @semantic-release/git plugin to .releaserc.json so that the version bump in package.json is committed back to the repo after each release
• Add @semantic-release/git ^12.0.0 to devDependencies
• Plugin is placed last in the plugins array (after @semantic-release/github) per recommended ordering

Problem

semantic-release creates GitHub releases and publishes to npm, but without @semantic-release/git the updated package.json version is never committed back to the repository. This means the version field in package.json on main drifts out of sync with the actual published version.

Test plan

• Verify .releaserc.json is valid JSON with correct plugin order
• Verify bun install succeeds with new devDependency
• Trigger a release (or dry-run npx semantic-release --dry-run) and confirm the git commit step appears in the plan

[Peyton-Spencer]

Blocking for merge readiness: @semantic-release/git@^12.0.0 does not exist on npm. The latest published dist-tag is 10.0.1, and the PR CI is failing at bun install --frozen-lockfile with No version matching "^12.0.0" found for specifier "@semantic-release/git".

The semantic-release ordering intent looks correct: @semantic-release/npm prepares the versioned package.json, and @semantic-release/git can then commit package.json during the prepare lifecycle. But this should not merge until the dependency spec is changed to a published version and CI passes.

I do not see bun.lock or provider dev dependency changes in this PR; the diff only touches .releaserc.json and package.json. Given CI uses bun install --frozen-lockfile while bun.lock is ignored, lockfile policy should be handled separately, but it is not introduced here.

[Peyton-Spencer]

Follow-up on current head a62bb214: the previous install blocker is resolved. The PR now uses @semantic-release/git@^10.0.1, which matches the current npm latest dist-tag, includes bun.lock, and current CI is green.

I do not see remaining merge-blocking issues. The semantic-release plugin order is suitable for the intended behavior: @semantic-release/npm runs before @semantic-release/git in the prepare lifecycle, so the versioned package.json can be committed with [skip ci] after npm prepares it.

Adding bun.lock is appropriate because both CI and release use bun install --frozen-lockfile; removing it from .gitignore makes the frozen install reproducible. The provider dev dependencies are also reasonable here because src/cli.ts dynamically imports @ai-sdk/openai, @ai-sdk/anthropic, and @ai-sdk/google, so the repo needs them available for build/typecheck while consumers still bring their chosen provider as documented.