0.9.1 - documentation that cannot drift

The documentation now derives its version from package.json instead of restating it.

Fixed in this pass:

• SECURITY.md advertised "4.x supported" on a project whose latest release is 0.9.0. Supported
  versions are now 0.9.x, with a sentence explaining why 0.9.0 is newer than 4.4.1 rather than older.
• Both setup examples printed 4.4.0 and 4.1.1 as the dependency the command adds. They now
  track the real version automatically.
• The 0.9.0 changelog section linked the docs at a domain with no DNS record.

The mechanism: docs carry marked spans (<!--@majorMinor-->0.9<!--/@majorMinor-->) that
scripts/sync-docs.mjs rewrites from package.json; code-block examples are matched by shape,
because inside a fence an HTML comment is literal text. npm run verify fails when anything is out
of step, and npm run site and prepack both sync first — so the docs site and the published README
cannot contradict the package they describe. This release is the proof: the version was bumped, and
the examples followed on their own.

Changelog history is deliberately excluded — it records what happened at each version.

npx codebase-snapshot@latest setup

Verified: lint clean, 506 tests / 502 pass / 0 fail on Node 18, 20 and 24, tarball 28 files.