Derive the bumped example list instead of hard-coding it

[ritz078]

Follow-up from the review of #101.

scripts/update-nutrient-in-examples.sh ends in 20 literal upgrade_npm_in_example calls, and scripts/update-nutrient-in-cdn.js carries a hand-maintained cdnOcurrences map of the same shape. In both, an example that is missing from the list is simply never visited: no error, no warning, no diff.

That is not hypothetical. The map keyed examples/gatsbyjs as gatsby, so the entry was never looked up and the example sat eight minor versions behind for months; examples/nuxtjs was absent from the map entirely. #101 fixed both and added guards that catch a key matching no directory, but the guards only cover the CDN map. The shell list is still unguarded, and a new example added to examples/ is silently never bumped.

Now that the bump runs unattended on a schedule, nobody is watching for the omission.

What this needs

Deriving the list means scanning examples/ for a lockfile and a @nutrient-sdk/viewer dependency, which turns an include-list into an exclude-list. The exclusions are the part that needs agreement rather than code:

• wasm-benchmark pins a version range on purpose and must not be bumped to an exact version.
• examples/salesforce/README.md documents the CDN URL with a worked @1.0.0 example and must never be rewritten. Automate SDK bump PRs, and fix the CODEOWNERS and CDN updater bugs #101 exempts it in the workflow check; a derived CDN map would need the same exemption.
• Whether any other example is deliberately held back is unconfirmed.

Both scripts should be done in one pass, since they share the failure mode.

Why it was left out of #101

It changes which examples get bumped, so it needs its own verification, and #101 was already rewriting one of the two scripts.