fix(cubejs): pin cube deps to 1.6.37 for reproducible builds

[acmeguy]

Problem

The cubejs image build (triggered by #58's merge) failed:

Error: Cube Store v1.6.68 Artifact for x86_64-unknown-linux-gnu doesn't exist.
Most probably it is still building. Please try again later.
#15 ERROR: process "yarn --network-timeout 100000" did not complete successfully: exit code: 1

Root cause is not #58. The Dockerfile runs yarn (non-frozen) against a lockfile that pre-dates the ^1.6.37 ranges in package.json, so every build re-resolves the cube packages to the newest release. v1.6.68 was published today at 14:56 UTC — 8 minutes before the build — and its arm64 cubestore binary was up but the x86_64 one (what the CI runner needs) was still uploading.

Fix

Pin the 30 direct @cubejs-backend/* deps to exact 1.6.37 — the version the service is developed and tested against (.env.example CUBESTORE_VERSION=v1.6.37, and what's installed locally), whose Linux binaries are published. Builds are now deterministic and won't chase brand-new upstream releases.

• Lockfile untouched (still valid v1); the exact pin makes the classic-yarn resolution deterministic at 1.6.37.
• cubestore runs as its own container (base/cubestore.yaml), so the cubejs image only needs a published binary version, not the newest.
• 013/014 cube test suites pass against 1.6.37 (60/60 on the touched suites; full suite 613/615 with 2 pre-existing unrelated failures).

Follow-up (separate, tested): regenerate the v1 lockfile to reflect 1.6.37 and add --frozen-lockfile so future drift fails fast instead of floating.

🤖 Generated with Claude Code