fix(deps): pin @smithy/util-retry to <=4.3.6

Upstream regression: @smithy/util-retry@4.3.7 was published at
2026-05-02T04:09:26Z with workspace:^ refs that escaped the smithy
monorepo. Any lockfile-free bun install (used by both
scripts/check-bench-agent.sh and scripts/smoke-test.sh — which mimic
'bun x mux@latest' for end users) fails to resolve those refs.

Reproduction outside this repo:
  mkdir t && cd t
  echo '{"dependencies":{"@aws-sdk/credential-providers":"^3.940.0"}}' > package.json
  bun install --ignore-scripts
  # → 'Workspace dependency "@smithy/types" not found'

This breaks every PR opened/pushed after 04:09Z (PR #3219 was lucky to
merge ~30 min before). Add an npm-style overrides pin to <=4.3.6 (the
last known-good release, 2026-04-28) until smithy republishes.

Verified locally: 'bash scripts/check-bench-agent.sh' now passes, and
@smithy/util-retry resolves to 4.3.6 in a fresh lockfile-free install.

Author: ammar-agent

bun.lock

@@ -316,6 +316,9 @@
     "npmRebuild": false,
     "buildDependenciesFromSource": false
   },
+  "overrides": {
+    "@smithy/util-retry": "<=4.3.6"
+  },
   "trustedDependencies": [
     "@swc/core",
     "core-js",