codegen pipelines don't detect _lib/*.ts changes so manifest CalVer never bumps

Description

All four codegen pipelines (codegen/aws/pipeline.ts:484, codegen/gcp/pipeline.ts:677, codegen/hetzner/pipeline.ts:281, codegen/digitalocean/pipeline.ts) compute manifest change detection as:

const hasChanges = hasChangedModels || readmeChanged || licenseChanged;

hasChangedModels is populated from per-service computeModelVersion calls only. The shared _lib/<provider>.ts file is generated separately (e.g. codegen/hetzner/pipeline.ts:203-206) and its content is never fed into hasChanges. Neither is it listed in the manifest's models: field (codegen/shared/manifestGenerator.ts:55-58 only iterates modelFiles).

Impact

When a codegen template change affects ONLY _lib/<provider>.ts:

1. hasChangedModels = false
2. Candidate manifest text equals existing manifest text → computeManifestVersion keeps the existing version
3. manifest.yaml is not rewritten on disk
4. publish.yml:29 filters on '*/manifest.yaml' diffs → no publish triggered
5. The fix ships to git but users pulling from the registry never see it

Precedent

PR #93 (no-import-prefix fix in generated deno.json) shipped without a version bump. CI didn't republish. PR #94 had to manually bump every manifest and every model file's version: field to force a republish. PR #94's commit message documents this exact failure mode:

"PR #93 fixed the no-import-prefix rule in the generated deno.json files but did not bump extension or model versions, so CI did not republish the updated extensions. Bump the manifest and all model file versions to 2026.04.23.2 to trigger a new publish with the fix."

Manual bumping also violates CLAUDE.md rule 1 ("never hand-edit files under model/").

Suggested Fix

Add hasLibFileChanged(outputDir, libFile) → Promise<boolean> to codegen/shared/version.ts: read existing file, run formatCode on candidate, compare. Each pipeline calls it once and ||s the result into hasChanges. Fits triage-conventions 'same symptom across providers → fix in codegen/shared/'.

Discovered During

Triage of swamp-club issue 41 (Hetzner firewall delete 422 retry). The retry fix is a _lib/hetzner.ts-only change, so it would have hit this exact bug without the pipeline fix or a manual bump step.