chore(deps): exclude @cipherstash/protect-ffi from the group bump

Dependabot's group update moved protect-ffi to 0.28.0 everywhere for group
consistency — which UPGRADED the sunsetting legacy packages/protect from its
pinned 0.23.0 (0.24+ renames the ProtectError/ProtectErrorCode exports it
imports, breaking its build) while DOWNGRADING the stack packages from 0.29.0.
protect-ffi is release-managed manually in this repo; restore every pin to
main's values and regenerate the lockfile.

Claude-Session: https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w

Author: coderdan

packages/protect/package.json

@@ -70,7 +70,7 @@
 	},
 	"dependencies": {
 		"@byteslice/result": "^0.2.0",
-		"@cipherstash/protect-ffi": "0.28.0",
+		"@cipherstash/protect-ffi": "0.23.0",
 		"@cipherstash/schema": "workspace:*",
 		"@stricli/core": "^1.2.9",
 		"dotenv": "17.4.2",

packages/stack-drizzle/package.json

@@ -79,7 +79,7 @@
 		"drizzle-orm": ">=0.33"
 	},
 	"devDependencies": {
-		"@cipherstash/protect-ffi": "0.28.0",
+		"@cipherstash/protect-ffi": "0.29.0",
 		"@cipherstash/test-kit": "workspace:*",
 		"fta-cli": "3.0.0",
 		"dotenv": "17.4.2",

packages/stack-supabase/package.json

@@ -69,7 +69,7 @@
 		}
 	},
 	"devDependencies": {
-		"@cipherstash/protect-ffi": "0.28.0",
+		"@cipherstash/protect-ffi": "0.29.0",
 		"@cipherstash/test-kit": "workspace:*",
 		"fta-cli": "3.0.0",
 		"@supabase/postgrest-js": "2.110.1",

packages/stack/package.json

@@ -228,7 +228,7 @@
 	"dependencies": {
 		"@byteslice/result": "0.2.0",
 		"@cipherstash/auth": "catalog:repo",
-		"@cipherstash/protect-ffi": "0.28.0",
+		"@cipherstash/protect-ffi": "0.29.0",
 		"evlog": "1.11.0",
 		"uuid": "14.0.1",
 		"zod": "3.25.76"