fix(release): bump examples/go and track go.work.sum on release

[samzong]

Summary

go.work.sum was permanently dirty: every go command rewrote it, so any local build left an unrelated modification in the worktree.

Root cause is a version skew introduced by the v0.1.4 release. go-cobra/go.mod moved to v0.1.4 but examples/go/go.mod stayed on v0.1.3, and both modules are in the workspace:

module	required github.com/lathe-cli/kitup/go
go-cobra/go.mod	v0.1.4
examples/go/go.mod	v0.1.3 (before this PR)

Minimal version selection picks the higher of the two, so go kept rewriting the tracked v0.1.3 line to v0.1.4.

scripts/prepare-release.mjs only knew about go-cobra/go.mod, so the skew would reappear on the next release. Both modules now go through the same replaceOne.

go.work.sum is also added to changedFiles. The script runs make check before git add, and that run rewrites the file, so leaving it out of the commit list would have reopened the same gap one release later.

Verification beyond make check:

• Deleting go.work.sum and letting the toolchain regenerate it reproduces the committed line byte for byte, so the committed content is the tool's steady state rather than a hand-written guess.
• A full check.mjs run no longer leaves the file dirty.
• prepare-release.mjs patch --dry-run exits 0, which also proves the version regex matches exactly once in both go.mod files — replaceOne fails when the match count is not 1.
• Bumping both modules to a version that does not exist on the module proxy still builds, since the workspace satisfies the dependency from ./go locally. A release run therefore does not need its own version published first.

Scope Check

• Stays within the v0.1 bundled-skill installer boundary.
• Does not add marketplace, registry, private remote install, script execution, GUI, MCP server, or agent runtime behavior.
• Updates golden cases for observable installer behavior changes. (Build metadata only; no installer behavior change.)
• Regenerates host constants after spec/hosts.json changes. (spec/hosts.json untouched.)

Verification

• make check