REQ-CI-002: The pin bump moves every place the reference is pinned, and nothing else

Anvil pins ex_git_objectstore in two places that must agree: the ref: in its mix.exs dependency and the SHA in its mix.lock. mix.exs is authoritative — a lock that disagrees is treated as stale and re-resolved from it — so a bump that edits only the lock has no effect. The bump rewrites both to the new SHA and changes nothing else in either file. It refuses to proceed, loudly, if either file does not contain the reference in the expected shape, rather than writing a file it did not understand. The generated pull request names the commits being pulled in, not just a SHA, so a reviewer can see what changed.