feat(ci): auto-update socketbin versions in provenance workflow

Add script to query npm registry for latest @socketbin/* package versions
and update socket package.json optionalDependencies before publishing.

This ensures the published socket package always references the most
recent socketbin binary packages instead of placeholder versions.

Changes:
- Add scripts/update-socketbin-versions.mjs to query npm for latest versions
- Update provenance.yml to run version update before preparing package
- Queries all @socketbin/* packages and pins to latest published versions

Author: jdalton

.github/workflows/provenance.yml

@@ -52,6 +52,8 @@ jobs:
       - run: pnpm install
 
       # Build and publish 'socket' package (default).
+      - name: Update socketbin versions in socket package
+        run: node scripts/update-socketbin-versions.mjs
       - name: Prepare socket package for publishing
         run: |
           SOCKET_VERSION=$(node -p "require('./packages/socket/package.json').version")

scripts/update-socketbin-versions.mjs

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+/**
+ * @fileoverview Update optionalDependencies in socket package.json with latest @socketbin/* versions from npm.
+ */
+
+import { readFileSync, writeFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { execSync } from 'node:child_process'
+
+const SOCKET_PKG_PATH = resolve('packages/socket/package.json')
+
+async function getLatestVersion(packageName) {
+  try {
+    const result = execSync(`npm view ${packageName} version`, {
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    })
+    return result.trim()
+  } catch (error) {
+    console.error(`Failed to get version for ${packageName}:`, error.message)
+    return null
+  }
+}
+
+async function main() {
+  console.log('📦 Updating @socketbin/* versions in socket package.json...\n')
+
+  // Read package.json.
+  const pkg = JSON.parse(readFileSync(SOCKET_PKG_PATH, 'utf-8'))
+
+  if (!pkg.optionalDependencies) {
+    console.error('❌ No optionalDependencies found in socket package.json')
+    process.exit(1)
+  }
+
+  // Get all @socketbin/* packages.
+  const socketbinPackages = Object.keys(pkg.optionalDependencies).filter(name =>
+    name.startsWith('@socketbin/'),
+  )
+
+  if (!socketbinPackages.length) {
+    console.error('❌ No @socketbin/* packages found in optionalDependencies')
+    process.exit(1)
+  }
+
+  console.log(
+    `Found ${socketbinPackages.length} @socketbin/* packages to update:\n`,
+  )
+
+  // Update each package to latest version.
+  const updates = []
+  for (const packageName of socketbinPackages) {
+    const currentVersion = pkg.optionalDependencies[packageName]
+    const latestVersion = await getLatestVersion(packageName)
+
+    if (!latestVersion) {
+      console.error(`❌ Failed to get latest version for ${packageName}`)
+      process.exit(1)
+    }
+
+    updates.push({
+      name: packageName,
+      old: currentVersion,
+      new: latestVersion,
+    })
+
+    pkg.optionalDependencies[packageName] = latestVersion
+    console.log(
+      `  ${packageName}: ${currentVersion} → ${latestVersion}`,
+    )
+  }
+
+  // Write updated package.json.
+  writeFileSync(SOCKET_PKG_PATH, `${JSON.stringify(pkg, null, 2)}\n`)
+
+  console.log(`\n✓ Updated ${updates.length} package versions`)
+  console.log(`✓ Wrote changes to ${SOCKET_PKG_PATH}`)
+}
+
+main().catch(error => {
+  console.error('Error:', error)
+  process.exit(1)
+})