fix: version the shinyreact HTMLDependency by the JS package version

[schloerke]

The shinyreact dependency was versioned by the bundle file's mtime, so a page loaded:

/lib/shinyreact-1789252719/shinyreact.js

A number that says nothing about which @posit-dev/shinyreact release is on the page. Now that the package is published, use its version:

/lib/shinyreact-0.1.1/shinyreact.js

Beyond being readable, this is checkable: an npm-tier app bundles its own copy of the runtime, and the page source now says which release the server is serving, so a version skew between the two is visible rather than inferred.

How the version gets there

make update-dist writes pkg-js/package.json's version to a one-line version.txt beside the bundle, in both packages — same committed-copy flow as the bundle itself. _bundle_version() (Python) and .bundle_version() (R) read it.

The fallback chain, and why it kept the mtime

version.txt → bundle mtime → per-language last resort.

The mtime is demoted rather than deleted on purpose. It existed to cache-bust the browser after a make update-dist, and in a dev checkout that still matters: several update-dist runs share one npm version, so a pure-version scheme would serve a stale cached bundle after a rebuild. Keeping mtime as the fallback covers the partially-built case, but note the tradeoff this PR does accept — in a normal checkout version.txt is present, so between releases repeated make update-dist runs now produce the same URL and a browser may serve a cached bundle until a hard refresh. If that bites, 0.1.1+<mtime> is a one-line change that restores busting while keeping the release legible; say the word.

A blank version.txt is treated as absent, not as an empty version — otherwise htmltools would build /lib/shinyreact-/.

The last-resort fallbacks are untouched, including their deliberate divergence: [py] the literal "0.1.0", [r] packageVersion("shinyreact").

Not touched

page_react_dep() — the app's bundle — still versions by ui.js's mtime. That is the cache-busting-during-development case the mtime scheme was designed for, and an app author's bundle has no npm version to use.

Tests

Six new/rewritten, three per language, mirrored and cross-referenced by name per the both-languages rule:

Claim	Python	R
version is the JS package version	test_dep_version_is_the_js_package_version	"versions by the JS package version"
missing version.txt → mtime	test_dep_version_falls_back_to_mtime_without_version_file	"version falls back to the bundle mtime"
blank version.txt → mtime	test_dep_version_ignores_an_empty_version_file	"ignores an empty version.txt"

make py-check-tests 199 passed · pyright 0 errors · full testthat suite passes · wheel build confirms shinyreact/www/version.txt ships (it is inside the hatchling package dir; inst/lib/shiny/ covers R).

FEATURES.md's "Asset delivery" leaves updated, with (test) markers on the three pinned claims.