Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>

* fix(release): don't require version field to start a line

writeManifestVersion anchored on ^ + multiline, requiring the version
field to open its own line. package.json always parses fine with
JSON.parse regardless of formatting, but the anchor made the rewrite
itself fragile - it hit the anchor-mismatch case on CI at least twice
(2026-08-18, 2026-08-24), aborting the v1.x publish workflow with a
false "no top-level version line" error.

Match the fleet's own canonical scripts/fleet/bump.mts, which drops
the anchor and matches the first "version": " occurrence anywhere in
the manifest.

* fix(release): match the fleet-canonical replacer exactly

Bring writeManifestVersion to byte-for-byte parity with the fleet's
scripts/fleet/bump.mts replaceVersion: require at least one character in
the existing version (an empty version is as broken as a missing one)
and use a replacer function instead of a $1${version}$2 template, which
would mis-substitute if the derived version ever contained a literal $.

The flag was hidden and hardcoded to false on `socket scan reach`, since
it relied on `--auto-manifest` generating the per-build-root Socket facts
first and that command has no such flag. Run the recursive facts
generation directly instead, so standalone reachability gets the same
per-project/module splitting `scan create` does. Without it, Gradle and
sbt projects analyzed through this path find no vulnerabilities at all.

Extract the recursive-facts step out of handle-create-new-scan into
run-dynamic-sbom-inference so both commands share one implementation and
one set of error messages, and give the flag a per-command description
since only `scan create` implies --auto-manifest.

* upgrading coana to version 15.10.24

* don't hand-write the version bump

The release workflow derives the version and writes package.json and the
CHANGELOG heading itself; the notes belong under [Unreleased] for it to
promote verbatim.

---------

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>
Co-authored-by: Jeppe Fredsgaard Blaabjerg <jfblaa@gmail.com>

The coana upgrade PRs hand-wrote their own version bumps into package.json
and CHANGELOG.md, which the release process explicitly owns. That produced
two `1.1.160` headings for a version that has no tag, no GitHub release, and
nothing on npm, plus a duplicate `1.1.159`.

It also cost 1.1.159 its notes: the hand-written heading consumed the
`[Unreleased]` block, so the real release found it empty and shipped with no
notes at all.

Fold the whole run back into `[Unreleased]`. The net user-facing delta since
1.1.158 — the last version npm actually serves — is the Coana bump chain,
already covered by the 15.10.24 entry. The changelog now lists exactly the
versions a user can install.

The coana upgrade PRs hand-wrote 1.1.160 into the manifest, a number that was
never released. The release process owns this field: between releases the
manifest holds the last released version and bump.mts advances it in-run.

With the manifest already sitting on 1.1.160, a patch release off the
v1.1.159 base derives that same 1.1.160, so writeManifestVersion's rewrite is
byte-identical and its `replaced === raw` guard throws "no top-level version
line" — a misleading message for a manifest whose version field is present and
well-formed. Restoring 1.1.159 lets the rewrite advance the field as intended.