chore: release core 0.7.46, server 0.8.58, cli 0.10.50

[vivek7405]

Releases the asset() helper (#1194, merged in #1197) across the three packages that carry it.

package	version	why it moves
@webjsdev/core	0.7.45 → 0.7.46	new asset() + setAssetUrlProvider exports
@webjsdev/server	0.8.57 → 0.8.58	resolveAssetUrl(), the dev-server provider install, the elision-fingerprint fix
@webjsdev/cli	0.10.49 → 0.10.50	the scaffold marks its own asset urls

Publish order

core must publish first, since server and cli both resolve asset from it. The publish loop sorts by the changelog date: ASC and tie-breaks on filename DESC, so equal timestamps would publish server before core. The generated timestamps are distinct and ordered core → server → cli:

2026-07-31T00:58:50.293Z  changelog/core/0.7.46.md
2026-07-31T00:58:50.353Z  changelog/server/0.8.58.md
2026-07-31T00:58:50.412Z  changelog/cli/0.10.50.md

Dependency range

packages/server's @webjsdev/core range moves ^0.7.1 → ^0.7.46. dev.js imports setAssetUrlProvider statically, so the old range was satisfied by every published core and none of them carried that export. npm could install a combination that dies at module load, and only publish ORDER was preventing it. This makes the coupling npm's problem instead. A release PR is the only branch where the version-bump hook permits this.

Verification

• npm ci resolves the tightened range against the regenerated lockfile.
• Changelogs are hook-generated by scripts/backfill-changelog.js, not hand-written.
• Full npm test in a clean worktree install: the only failures are test/integration/blog-http.test.mjs, which fail identically at origin/main in the same worktree (verified by detaching and re-running). No regression from this commit.