Bump bundled worker to 1.29.1 (release-2.18.0)

[elias-ba]

Description

Bumps the bundled worker from 1.27.4 to 1.29.1 on release-2.18.0.

This is the other half of #5064. Lightning sends the new meta object, but only worker 1.29.1 maps it onto the meta global a job can read. Without this bump the release would bundle 1.27.4 and meta.workOrderId simply wouldn't appear, with nothing failing loudly - there's no version negotiation between Lightning and the worker.

Note this branch was on 1.27.4, not 1.29.0: the earlier bump (#5050) went to main and was never cherry-picked here.

Mirrors #5050 - the pin, the regenerated lock file, and the version the integration test asserts on. The lock file also moves engine-multi to 1.13.0 and lexicon, as transitive deps of the worker.

Validation steps

1. Run a workflow from the bundled worker with log(meta) using common.
2. meta should include workOrderId, workflowId and projectId once Send more metadata with a run (release-2.18.0) #5064 is in.
3. test/integration/web_and_worker_test.exs asserts the worker version it sees, now 1.29.

Additional notes for the reviewer

Worth merging after #5064 so the feature and the worker that supports it land together.

AI Usage

Please disclose whether you've used AI anywhere in this PR (it's cool, we just want to know!):

• I have used Claude Code
• I have used another model
• I have not used AI

You can read more details in our Responsible AI Policy

[github-actions]

Security Review ✅

• S0 (project scoping): Lightning.Workflows.unique_workflow_name/2 at lib/lightning/workflows.ex:241 still filters by project_id, and its caller WorkflowChannel.validate_workflow_name (lib/lightning_web/channels/workflow_channel.ex:456) still derives project from socket.assigns set at authenticated join; no other project-scoped queries were introduced.
• S1 (authorization): N/A — no new create/read/update/delete web-layer actions; the AI-assistant channel and workflow-channel diffs only remove/rename existing handlers and the sandbox-live change is a tooltip refactor.
• S2 (audit trail): N/A — no new writes to config resources; the GCS rewrite in lib/lightning/storage/gcs.ex swaps the transport but touches only user-uploaded project file blobs (already audited at the Projects.File layer), and the removed migration is a rollback of an unused response_segments column on chat messages, which are not config resources.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (release-2.18.0@9b7934f). Learn more about missing BASE report.

Additional details and impacted files

@@               Coverage Diff                @@
##             release-2.18.0   #5067   +/-   ##
================================================
  Coverage                  ?   90.6%           
================================================
  Files                     ?     422           
  Lines                     ?   20032           
  Branches                  ?       0           
================================================
  Hits                      ?   18152           
  Misses                    ?    1880           
  Partials                  ?       0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.