fix(deps): pin cake_backup and bech32 refs in cw_core to match root

Pub requires identical git descriptors across the graph: the root's
pinned SHAs (pubspec_base) conflicted with cw_core's ref:main /
unpinned declarations, failing CI's pub resolve after the configure
step regenerates pubspec.yaml. Local resolution had masked it because
the untracked working-tree pubspec.yaml predated the pins. Pins now
identical everywhere (audit script confirms no remaining multi-ref git
deps); sibling lockfiles re-locked.

cw_bitcoin/pubspec.lock

@@ -59,7 +59,7 @@ packages:
     dependency: transitive
     description:
       path: "."
-      ref: HEAD
+      ref: "05755063b593aa6cca0a4820a318e0ce17de6192"
       resolved-ref: "05755063b593aa6cca0a4820a318e0ce17de6192"
       url: "https://github.com/cake-tech/bech32.git"
     source: git
@@ -223,7 +223,7 @@ packages:
     dependency: transitive
     description:
       path: "."
-      ref: main
+      ref: "3aba867dcab6737f6707782f5db15d71f303db38"
       resolved-ref: "3aba867dcab6737f6707782f5db15d71f303db38"
       url: "https://github.com/cake-tech/cake_backup.git"
     source: git