Bump moonbitlang/async to 0.22.4

[bobzhang]

Bump moonbitlang/async to 0.22.4 (latest).

Since async 0.22.0, catch no longer captures cancellation; cleanup must live in defer/errdefer. This PR bumps the dependency and audits every catch around async code.

Change: Bump moonbitlang/async 0.21.2 → 0.22.4 (root module; lexer and moon_config don't use async). No source changes.

Cancellation audit: 10 catch sites in cmd/mq and cmd/moonfmt reviewed; each converts an error to a message and exit or ignores a failed stderr write. None changed. The existing add_defer already passes a protect_from_cancel callback.

Verification: Identical before and after: root 2754 (wasm-gc, js), 2759 (native), 2757 (wasm); workspace 2835/2840/2838; lexer 23, moon_config 58 on all targets.

Commits:

• dcd5db6 chore(deps): bump moonbitlang/async to 0.22.4

🤖 Generated with Claude Code

[bobzhang]

Automated review by Codex CLI:

No actionable findings.

• The single commit changes only moon.mod: async 0.21.2 → 0.22.4. No fmt or .mbti changes.
• All async command catch handlers handle diagnostics or exit codes; none performs cleanup requiring migration.
• Test directory cleanup already uses add_defer with protect_from_cancel, satisfying nocancel. It runs once after group termination, including cancellation, without premature or duplicate removal.
• No obsolete cancellation API usages found. The dependency’s file helpers use defer to close files.

git diff --check passed. Builds/tests were not run under the read-only restriction.

VERDICT: APPROVE

CI green. Merging as a low-risk dependency bump; a release follows.

🤖 Generated with Claude Code