refactor: pin the Coana CLI version in the source

[Oskar Haarklou Veileborg (BarrensZeppelin)]

The pinned Coana CLI version moves from the @coana-tech/cli devDependency,
which rollup inlined at build time, to the COANA_CLI_VERSION constant in
src/constants.mts. Coana is about to stop publishing to npm, so the pin
can't stay a dependency, and the constant also has the same value in
tests and in unbuilt runs, where the inlined value was empty.

The bump-coana skill now edits the constant. Coana's release workflow has
to bump it the same way.

Part of REA-875.

Coana's release workflow (publish-cli.yml in coana-package-manager) still bumps the devDependency, and needs to edit COANA_CLI_VERSION before its next automated bump PR.

Expected reviewer effort: Stamp

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

---

Note

Medium Risk
Changes the default Coana version source for fix, reachability, and dlx launch paths; wrong bumps would affect analysis behavior but scope is a straightforward constant swap.

Overview
Pins the default Coana CLI version in source instead of treating @coana-tech/cli as a devDependency that Rollup inlined at build time.

Adds exported COANA_CLI_VERSION in src/constants.mts and wires fix, reachability, and spawnCoanaDlx (plus CLI help text) to use it. Removes @coana-tech/cli from package.json / lockfile and drops the INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION Rollup replace path.

The bump-coana skill now updates only src/constants.mts and CHANGELOG.md (no pnpm install / lockfile step). Test snapshot normalization reads the same constant instead of package.json.

^{Reviewed by Cursor Bugbot for commit c7e26b1. Configure here.}