chore(deps): bump commerce-elastic-path to 0.6.0 in canvas-packages, loader-bundle-env and the example app

[field123]

0.6.0 is published, so the three in-repo consumers that resolve this package from npm can re-resolve. They could not move in #558 — yarn cannot resolve a range until a tarball declaring it exists, which is why the bump and the lockfiles are separate PRs.

This carries Manual checkout and the order-first payment sequence into the hostless bundle. publish-hostless builds canvas-packages with --frozen-lockfile, so it registers EP Manual Payment only once this has landed; running it before would have succeeded while silently bundling 0.5.3.

Verified

• All three lockfiles resolve to 0.6.0 with shasum 3d98983857c8501a276d1890f251892f5197fac7, matching the published tarball
• platform/canvas-packages yarn build (tsc + esbuild) exits 0
• Both built canvas bundles contain plasmic-commerce-ep-manual-payment / "EP Manual Payment"
• The example app typechecks and next build passes against 0.6.0; against 0.5.3 it fails with three TS2305 for createManualAdapter, handleResumePayment and handleAbandonPayment

Merging this triggers deploy-integration via the loader-bundle-env path. publish-hostless at environment=integration should run only after that deploy settles.

Refs #557, #559