#1050 chore(release): prepare SDK v0.29.0

Prepares SDK v0.29.0 with make bump VERSION=0.29.0. The tag follows once this merges.

Release scope since v0.28.1

• #1044: the Go event-feed connector renews a ticket stream in band before its token expires. When a socket's welcome advertises stream_expires_at, the connector sends a fresh ticket over the open socket about three minutes ahead of the deadline, retries a failed renewal once, and otherwise lets the server's lease close the socket and reconnects as before. Observer gains StreamDeadline, Renewed and RenewFailed. There's nothing to configure, and a server that advertises no deadline sees no change. SPEC.md §23 and six new event-feed conformance fixtures (36–41) cover it.
• #1046, #1047, #1048: Dependabot bumps (oxlint in TypeScript, tokio in Rust and its conformance runner).

It's a minor release because #1044 adds new behaviour. Nothing breaks: the Observer fields and RenewFailure are additions, and no interface gains a method. One thing for embedders: WithClock's Clock.Now is now documented as reading wall time, because renewal schedules against the server's deadline. A clock that counts from boot mistimes renewal but loses nothing, since an unrenewed socket reconnects and catches up. MIGRATING.md has no Unreleased section, so this version ships without migration notes, as v0.28.1 did.

The diff

19 files, 22 lines changed each way, every one a version substitution (0.28.1 to 0.29.0) in the 11 version files and 8 lockfiles. These are the same files #1043 touched. As in #1043, the local npm (10.9.3) also dropped the libc fields from both TypeScript lockfiles. I reverted that and kept only the three version lines.

make release VERSION=0.29.0 passes every check on this branch, including rs-publish-check's cargo publish --dry-run, and then stops at the branch guard, as it should.

Not related to this release

Known-defect tracking issues are open is still red on main and isn't required. No release workflow runs it.