fix(release): use --legacy-peer-deps when refreshing infra lockfiles

The "Sync published workspace versions" step runs `npm install
--package-lock-only` in each infra/*/ dir to refresh stale @bsv/* ranges
after sync-versions. infra/message-box-server carries transitional lint
devDeps with a peer conflict (eslint-plugin-react@7.37.x peers eslint
<=9.7, but the package pins eslint 10), causing npm ERESOLVE and failing
the release (also broke releases for #203 and #204).

This step only regenerates the lockfile (--package-lock-only
--ignore-scripts); no lint runs here, so accept the legacy peer
resolution instead of failing the whole release on a dev-only graph.

Deeper fix (realigning message-box-server's eslint/ts-standard stack) is
a separate follow-up.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sirdeggen

.github/workflows/release.yaml

@@ -169,11 +169,15 @@ jobs:
           # their @bsv/* ranges. Refresh each infra lockfile so the Dockerfile
           # `npm ci` step won't fail with "lockfile doesn't match" on the next
           # infra-release build. --package-lock-only skips node_modules I/O.
+          # --legacy-peer-deps: some infra components (e.g. message-box-server)
+          # carry transitional lint devDeps with peer conflicts (eslint-plugin-react
+          # vs eslint 10); this step only refreshes the lockfile, so accept the
+          # legacy peer resolution rather than fail the release on a dev-only graph.
           for d in infra/*/; do
             [ -f "$d/package.json" ] || continue
             [ -f "$d/package-lock.json" ] || continue
             echo "Refreshing lockfile in $d"
-            (cd "$d" && npm install --package-lock-only --ignore-scripts)
+            (cd "$d" && npm install --package-lock-only --ignore-scripts --legacy-peer-deps)
           done
 
           if git diff --quiet; then