build(release): pin pnpm-release-management to bb3b8b5 for repository changelogs and pr after bump

[systemfsoftware-maker]

Summary

This bumps flake.lock's pnpm-release-management input from 603ecb4 to bb3b8b5. That rev includes:

• pnpm-release-management#36: bump writes each member's CHANGELOG.md under versioning.changelog.storage: repository.
• pnpm-release-management#37: pr opens the release PR from the tree bump left, and commits only tracked changes plus the changelogs bump created.

Nothing else is needed. This repo already sets storage: repository in pnpm-workspace.yaml, the dev shell already carries the pinned pnpm (#232), and the reusable workflow already runs bump then pr. The diff is flake.lock only.

Evidence (throwaway git clone --no-local of this branch, deleted afterwards)

• a. nix develop --command version-management bump exits 0 and prints versioned packages.
  • @systemfsoftware/stryker-js moves to 18.0.0.
  • The tree shows 35 modified, 20 deleted (intents) and 1 new file. 18 CHANGELOG.md files changed or appeared, one of them new: test/e2e-core/CHANGELOG.md. Each gains a ## <version> section; for stryker-js that is ## 18.0.0.
  • .changeset/changelogs/ does not exist afterwards, so nothing is parked.
• b. pnpm guard:projects exits 0: 17 publishable package(s) each carry exactly one section for their version, and no section is parked.
• c. Setup: a scratch bare remote via url.<bare>.pushInsteadOf, and a fake GitHub API via GITHUB_API_URL (pr has no dry-run). Before running pr, I put an untracked .release/captured.json and a result symlink in the checkout.
  • github-release-management pr exits 0 and prints created release PR #1.
  • The fake API received GET pulls?head=changeset-release/main, POST /pulls (title chore(release): version packages) and POST /issues/1/labels ["release"].
  • changeset-release/main on the bare remote has one commit, chore(release): version packages. Its diff is 1 A, 20 D and 35 M, the same set bump produced. Zero paths match .release/ or result.
  • git status afterwards shows only ?? .release/captured.json.
• d. github-release-management release --dry-run exits 0 and prints dry run: 17 release(s), including @systemfsoftware/stryker-js@v18.0.0. The release phase refuses with ReleaseChangelogMissing or ReleaseChangelogEmpty whenever a member's notes are missing or empty, so exit 0 over all 17 means every release has non-empty notes.

Nothing was run with stryker.

[kiro-systemf]

Verified: 11/11 green on 8277aef; flake.lock only; a-d evidence shows bump writes CHANGELOG sections (stryker-js 18.0.0), the guard passes, pr against a bare remote commits exactly the bump's tree with no artifacts, and the release dry-run lists 17 releases with notes.