fix(packages): core 0.25.2 + ui 0.38.1, and a package smoke that catches an unpublished core subpath

[backnotprop]

Problem

@plannotator/ui 0.38.0 does not install into a consumer (reported by the Workspaces bump PR #400). config/settings.ts imports @plannotator/core/token-hover, added to core by #1462 without bumping core, so 0.38.0 pins core 0.25.1, which never published that subpath. The path is unavoidable for any host: configure → config/configStore → config/settings.

The preflight (smoke:package) passed anyway, for two reasons: its external consumer installs core from the local tarball via a pnpm override, so an export present in source but absent on the registry is invisible, and its consumer entry never imported the configure/config path.

Fix

• core 0.25.2: publishes ./token-hover plus what core accumulated since 0.25.1 (rotated guide-viewer-manifest pin, config-types hover fields). Patch bump follows the 0.25.0 → 0.25.1 precedent for an additive subpath.
• ui 0.38.1: 0.38.0 pinning core 0.25.2. Also aligns @codemirror/state to ^6.7.2 beside @codemirror/view ^6.43.10 (the consumer otherwise resolves two state copies and tsc rejects the private dispatchTransactions; same root as the QA-gate duplicate-copy finding).
• smoke:package hardened, three layers:
  1. every @plannotator/core/<subpath> the UI source imports must be an export of the core source manifest;
  2. when the pinned core version already exists on the registry, every such subpath must be exported by that published core, and the core source exports must equal the published ones exactly, otherwise "bump core and publish it first"; when the pinned version is not published yet it prints the publish-core-first reminder;
  3. the external consumer now imports @plannotator/ui/configure and @plannotator/ui/config and calls configurePlannotatorUI({}), so its vite build and tsc compile the settings path.
• HANDOFF / README: current pair 0.38.1 on 0.25.2; "do not consume ui 0.38.0" added to the install matrix with the reason.

Verification

• Positive: bun run --cwd packages/ui smoke:package on this branch passes and prints @plannotator/core@0.25.2 is not on the registry yet: publish core FIRST.
• Negative: with packages/core set back to 0.25.1 and the UI pin to 0.25.1 (exactly the published 0.38.0 state), the smoke fails: UI imports @plannotator/core/token-hover but the PUBLISHED @plannotator/core@0.25.1 does not export it. Restored afterwards; bun.lock diff is version lines only.

Publish order after merge (owner, manual)

1. cd packages/core && bun pm pack && npm publish plannotator-core-0.25.2.tgz --tag next --access public
2. cd ../ui && bun run smoke:package (now checks the registry) && bun pm pack && npm publish plannotator-ui-0.38.1.tgz --tag next --access public
3. Verify, then promote both to latest.
4. Consider npm deprecate @plannotator/ui@0.38.0 "does not compile: pins core 0.25.1 without ./token-hover; use 0.38.1".

Do not publish from this PR.