build: pin exact flutter version in pubspec as single source of truth

- add `flutter: 3.44.2` to environment so `flutter pub get` fails locally
  the moment the SDK drifts (was already drifting: local 3.44.2 vs the
  3.44.1 pinned in CI)
- point all 8 workflow pins at `flutter-version-file: pubspec.yaml` so CI
  reads the same field; bumping Flutter is now a one-line pubspec edit
  instead of editing 5 workflow files

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
           java-version: 21
       - uses: subosito/flutter-action@v2
         with:
-          flutter-version: 3.44.1
+          flutter-version-file: pubspec.yaml
           cache: true
       - run: flutter doctor -v
       - run: flutter pub get
@@ -53,7 +53,7 @@ jobs:
           xcode-version: latest-stable
       - uses: subosito/flutter-action@v2
         with:
-          flutter-version: 3.44.1
+          flutter-version-file: pubspec.yaml
           cache: true
       - run: flutter pub get
       - run: flutter build ios --release --no-codesign

.github/workflows/gh-release.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Set up Flutter
         uses: subosito/flutter-action@v2
         with:
-          flutter-version: 3.44.1
+          flutter-version-file: pubspec.yaml
           cache: true
       
       # Decode and create the upload-keystore.jks file, used for signing the app.

.github/workflows/pr-check.yml

@@ -16,7 +16,7 @@ jobs:
           java-version: 21
       - uses: subosito/flutter-action@v2
         with:
-          flutter-version: 3.44.1
+          flutter-version-file: pubspec.yaml
           cache: true
       - run: flutter doctor -v
       - run: flutter pub get

.github/workflows/release-dryrun.yml

@@ -53,7 +53,7 @@ jobs:
       - name: Set up Flutter
         uses: subosito/flutter-action@v2
         with:
-          flutter-version: 3.44.1
+          flutter-version-file: pubspec.yaml
           cache: true
 
       # Decode and create the upload-keystore.jks file, used for signing the app.
@@ -105,7 +105,7 @@ jobs:
       - name: Set up Flutter
         uses: subosito/flutter-action@v2
         with:
-          flutter-version: 3.44.1
+          flutter-version-file: pubspec.yaml
           cache: true
 
       # Setup the iOS project with environment variables without signing (building and signing will happen in fastlane).

.github/workflows/store-release.yml

@@ -49,7 +49,7 @@ jobs:
       - name: Set up Flutter
         uses: subosito/flutter-action@v2
         with:
-          flutter-version: 3.44.1
+          flutter-version-file: pubspec.yaml
           cache: true
 
       # Decode and create the upload-keystore.jks file, used for signing the app.
@@ -101,7 +101,7 @@ jobs:
       - name: Set up Flutter
         uses: subosito/flutter-action@v2
         with:
-          flutter-version: 3.44.1
+          flutter-version-file: pubspec.yaml
           cache: true
 
       # Setup the iOS project with environment variables without signing (building and signing will happen in fastlane).

pubspec.lock

@@ -1530,4 +1530,4 @@ packages:
     version: "3.1.3"
 sdks:
   dart: ">=3.12.0 <4.0.0"
-  flutter: ">=3.44.0"
+  flutter: "3.44.2"

pubspec.yaml

@@ -21,6 +21,9 @@ version: 5.1.0+69
 
 environment:
   sdk: ^3.9.0
+  # Exact Flutter pin, enforced by `flutter pub get` locally and read by CI via
+  # `flutter-version-file: pubspec.yaml`. Single source of truth: bump here.
+  flutter: 3.44.2
 
 # Dependencies specify other packages that your package needs in order to work.
 # To automatically upgrade your package dependencies to the latest versions