feat(release): bump and commit a release family in one command

release:dsh takes major, minor, patch, or an explicit version and writes one
version across the family; release:vendor takes none and increments each
package's own patch, but only for packages whose published payload changed since
their vendor-<package>-v* tag. That tag is the record of the commit a package
last published from, so the change judgement needs no state file, and the diff
is filtered through the manifest's files rules - editing a vendored comment does
not trigger a release.

Both refresh the lockfile, commit, and print the tag to create after the commit
merges. --dry-run reports the plan and writes nothing.

Incrementing the release numbers is also what drops an upstream prerelease
segment: cordis 4.0.0-rc.7 publishes as 4.0.1, because a prerelease version
would not satisfy a consumer's plain range.

package.json

@@ -121,6 +121,8 @@
     "doc-sync": "tsx scripts/run-gates.ts doc-sync",
     "hygiene": "pnpm run rescope-vendor:check && pnpm run knip && pnpm run publint && pnpm run constraints && pnpm run verify-package-invariants && pnpm run verify-built-package-invariants && pnpm run verify-cordis-config && pnpm run verify-node-next-types && pnpm run verify-runtime-closure && pnpm run verify-vendored-links",
     "publish:npm-baseline": "tsx scripts/publish-npm-baseline.ts",
+    "release:dsh": "tsx scripts/release/bump.ts --family dsh",
+    "release:vendor": "tsx scripts/release/bump.ts --family vendor",
     "release:verify": "tsx scripts/release/verify.ts",
     "release:pack": "tsx scripts/release/pack.ts",
     "release:verify-packed-install": "tsx scripts/release/verify-packed-install.ts",