Maintenance release. Four framework versions, additive only:
HTTP SSE per-request retention leak fix, ctx.sessionId surfaced on
Context for HTTP handlers (fail-closed under stateless mode),
ctx.auth.token strip fix in toAuthContext so handlers can relay the
bearer upstream, and telemetry visualization docs (Grafana dashboard
JSON, query recipes, new api-telemetry skill).

Consumer-visible knock-on: Node engine floor ≥22 → ≥24 to match
upstream. Dockerfile base pinned oven/bun:1 → oven/bun:1.3.
@types/node ^25.6.0 → ^25.6.2 (devDep).

Tool/prompt copy: better recovery hints in search-entities and
analyze-trends (point at the upstream message + rejected token, or
name concrete group_by fields per entity_type), entity_type output
in resolve-name enumerates the concrete set, marketing asides removed,
literature-review and research-landscape topic args carry example
shapes.

Build infra: changelog template + build-changelog.ts gain a
security frontmatter flag with a parallel 🛡️ Security badge in the
rollup, alongside the existing breaking flag.

Skills: new api-telemetry mirror; api-context, api-utils, maintenance,
report-issue-framework, report-issue-local, setup resynced from
package.

devcheck, rebuild, all 107 tests passing.