refactor(publish): fix publish order and remove update script

Publish order now:
1. @socketsecurity/cli and @socketsecurity/cli-with-sentry (independent)
2. @socketbin/* SEA binaries (8 platforms)
3. socket (last, depends on @socketbin/*)

Changes:
- Reorder publish steps so socket is last
- Remove update-socketbin-versions.mjs (not needed with lockstep)
- Update preparePackageForPublish to set optionalDependencies version

All packages use the same VERSION, so socket's optionalDependencies
are set to VERSION at publish time (no npm fetch needed).

Author: jdalton

.github/workflows/publish.yml

@@ -182,39 +182,37 @@ jobs:
           done
 
       # Build and publish JS packages.
+      # Order: cli/cli-with-sentry first (independent), then socket (depends on @socketbin/*).
       - name: Build CLI
         run: INLINED_SOCKET_CLI_PUBLISHED_BUILD=1 pnpm run build
 
-      - name: Update socketbin versions
-        if: ${{ inputs.publish-socket }}
-        run: node scripts/update-socketbin-versions.mjs --prod
-
-      - name: Publish socket
-        if: ${{ inputs.publish-socket && !inputs.dry-run }}
+      - name: Publish @socketsecurity/cli
+        if: ${{ inputs.publish-cli && !inputs.dry-run }}
         env:
           VERSION: ${{ steps.version.outputs.version }}
         run: |
-          PKG_DIR="packages/package-builder/build/prod/out/socket"
+          PKG_DIR="packages/package-builder/build/prod/out/cli"
           node scripts/prepare-package-for-publish.mjs "$PKG_DIR" "$VERSION"
           cd "$PKG_DIR"
           npm publish --provenance --access public --no-git-checks
 
-      - name: Publish @socketsecurity/cli
-        if: ${{ inputs.publish-cli && !inputs.dry-run }}
+      - name: Publish @socketsecurity/cli-with-sentry
+        if: ${{ inputs.publish-cli-sentry && !inputs.dry-run }}
         env:
           VERSION: ${{ steps.version.outputs.version }}
         run: |
-          PKG_DIR="packages/package-builder/build/prod/out/cli"
+          PKG_DIR="packages/package-builder/build/prod/out/cli-with-sentry"
           node scripts/prepare-package-for-publish.mjs "$PKG_DIR" "$VERSION"
           cd "$PKG_DIR"
           npm publish --provenance --access public --no-git-checks
 
-      - name: Publish @socketsecurity/cli-with-sentry
-        if: ${{ inputs.publish-cli-sentry && !inputs.dry-run }}
+      # socket published last - depends on @socketbin/* being published first.
+      - name: Publish socket
+        if: ${{ inputs.publish-socket && !inputs.dry-run }}
         env:
           VERSION: ${{ steps.version.outputs.version }}
         run: |
-          PKG_DIR="packages/package-builder/build/prod/out/cli-with-sentry"
+          PKG_DIR="packages/package-builder/build/prod/out/socket"
           node scripts/prepare-package-for-publish.mjs "$PKG_DIR" "$VERSION"
           cd "$PKG_DIR"
           npm publish --provenance --access public --no-git-checks

packages/package-builder/scripts/utils/prepare-package.mjs

@@ -14,6 +14,7 @@ const logger = getDefaultLogger()
  * - Removes private field
  * - Sets version if provided
  * - Sets buildMethod if provided
+ * - Updates optionalDependencies versions (for lockstep publishing)
  *
  * @param {string} packageDir - Path to the package directory
  * @param {object} [options] - Options
@@ -35,6 +36,13 @@ export function preparePackageForPublish(packageDir, options = {}) {
   // Set version if provided.
   if (version) {
     pkg.version = version
+
+    // Update optionalDependencies to use the same version (lockstep).
+    if (pkg.optionalDependencies) {
+      for (const dep of Object.keys(pkg.optionalDependencies)) {
+        pkg.optionalDependencies[dep] = version
+      }
+    }
   }
 
   // Set buildMethod if provided (for socketbin packages).