test: spa-build-source pin literal follows the 0.20.50 App pin (un-breaks main CI) (#214)

PR #213 bumped scripts/spa-source.env without the test literal — the pin-agreement
test is doing its job; this brings the expectation current.


Claude-Session: https://claude.ai/code/session_01XLZtmuSs1RirWGMGyCB1QB

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: unforced

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/cloud",
-  "version": "0.0.8-rc.120",
+  "version": "0.0.8-rc.121",
   "private": true,
   "description": "Open Parachute PBC's Vault Cloud \u2014 one Durable Object per vault on Cloudflare, OAuth issuer + self-serve console (accounts + vault ownership).",
   "license": "AGPL-3.0",

test-bun/spa-build-source.test.ts

@@ -53,7 +53,7 @@ describe("served SPA source", () => {
     const sourcePin = read("scripts/spa-source.env");
     const script = read("scripts/build-spa.sh");
 
-    expect(sourcePin).toContain('SPA_APP_VERSION="0.20.21"');
+    expect(sourcePin).toContain('SPA_APP_VERSION="0.20.50"');
     expect(sourcePin).toMatch(/SPA_APP_REF="[0-9a-f]{40}"/);
     expect(script).toContain('source "$ROOT/scripts/spa-source.env"');
     expect(script).toContain("SPA_APP_REF");