fix(dist): C# sidecar survives unresolvable global.json (#134) + dep bumps

[MelbourneDeveloper]

Summary

Hardens the C# sidecar against unresolvable workspace SDK pins, makes VSIX packaging work without an explicit release version, and folds in the pending Dependabot updates.

C# sidecar: resilient, workspace-independent SDK discovery — fixes #134

Previously the C# sidecar resolved MSBuild via MSBuildLocator.RegisterDefaults(), which runs hostfxr_resolve_sdk2 against the workspace working directory. When a workspace global.json pinned a version/rollForward band with no installed match (e.g. Fantomas pinning 10.0.100 on a box with only 10.0.203), discovery threw and the sidecar exited before READY — crash-looping and taking down the Solution Explorer even for F#-only solutions.

• MSBuildInstanceSelector now enumerates installed SDKs from a neutral working directory (no global.json in its ancestry) via QueryVisualStudioInstances(DiscoveryType.DotNetSdk), then selects the SDK whose Roslyn matches the bundled Microsoft.CodeAnalysis — so a workspace pin can neither constrain nor crash discovery.
• Every failure mode (discovery throws, no SDK installed, no Roslyn match) now degrades instead of crashing: it logs one actionable, once-per-process hint and leaves MSBuild unregistered. The process still reaches READY and serves MSBuild-free requests (solution/read, ping, shutdown); Roslyn-backed handlers fail per-request with a clear message.
• New spec section [DIST-SDK-DISCOVERY] in docs/specs/DISTRIBUTION-SPEC.md documents the working-directory hazard and the degrade-never-crash contract.
• New coarse e2e coverage in GlobalJsonSdkPinEndToEndTests.cs spins up the sidecar apphost with a bad-global.json cwd and asserts it reaches READY.

Packaging: VERSION is optional for package-vsix-*

The package-vsix-* Make targets no longer hard-require a VERSION. When omitted they fall back to a 0.0.0 placeholder (valid SemVer, no -, so it never trips the --pre-release path), letting local and CI dry-run packaging produce a VSIX without a release number. Release builds still override explicitly (VERSION=0.12.0).

Dependency updates (Dependabot)

• rust-host (build(deps): bump the rust-host group with 3 updates #129): lsp-server 0.7→0.8, tree-sitter 0.26.9→0.26.10, anyhow 1.0.102→1.0.103
• rust-zed (build(deps): bump quick-xml from 0.40.1 to 0.41.0 in /editors/zed in the rust-zed group #127): quick-xml 0.40→0.41
• vscode-extension (build(deps): bump the vscode-extension group in /editors/vscode with 7 updates #131): eslint 10.4.1→10.6.0, playwright 1.61.0→1.61.1, + others
• website (build(deps): bump @playwright/test from 1.61.0 to 1.61.1 in /website in the website group #128): @playwright/test 1.61.1
• github-actions (build(deps): bump the github-actions group with 3 updates #130) / dotnet-sidecars (Bump the dotnet-sidecars group with 4 updates #116): actions/setup-dotnet → v5.4.0, sidecar package bumps

CI hygiene

• Reverted an accidental 0.0.0 version stamp (a placeholder leaked in from local packaging) back to the 0.1.0 source baseline across all manifests — release versions come from the tag via release.yml, so source stays at baseline.
• Reformatted two e2e test files that drifted against the current prettier@3 (formatting only — no assertions changed).

Test plan

Full local CI parity, all green:

• lint: Rust clippy+fmt, Zed clippy, CsharpIer, .NET analyzers, sidecar dotnet pack (both), prettier, VSIX eslint+tsc
• test-dotnet: 733 tests (407 C# + 326 F#), coverage above gate
• test-rust: nextest + llvm-cov, release binary + version contract
• test-vsix: full VS Code e2e suite + VSIX platform-binary check