The release metadata and package manifests now point to the next patch version so publish pipelines can ship the updated tarball.

Constraint: User requested version bump and git publication in this turn
Rejected: Skip README release notes update | violates repository release hygiene for version bumps
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Keep package.json/package-lock.json and README release notes in sync on every version bump
Tested: node --check bin/multiagent-safety.js
Tested: node --test test/metadata.test.js
Tested: npm pack --dry-run
Tested: npm test (fails pre-existing setup baseline: requireValue/parseDoctorArgs undefined across many install tests)
Not-tested: end-to-end npm publish to registry