v0.4.21

Fix: consort-upgrade now refreshes the whole templates/project/common/ root, and consort's bundled scm-utils templates are re-vendored via a real install.

• refreshSurface generalized — reads the whole common/ root and copies every kit file except a project-owned skip-set (deploy-targets.yaml/.env.example/.gitignore.base/DO-NOT-MODIFY.md), returning the copied names so commitRefreshedSurface stages them. No enumeration — a new kit root file flows automatically. Previously it copied only .claude/{agents,commands,skills} + scripts/ + .github/workflows/, so upgraded/rehydrated projects were missing the 0.3.4 root test-capture files (consort-capture.ts, consort-test-reporter.ts) and the build halted on a scaffold-defect (Vitest/Playwright could not start).
• scm-utils re-vendored — consort's bundle was frozen at 0.3.1 because every repoint was a surgical lockfile edit (node_modules never moved). Repointed via a REAL npm install (node_modules now 0.3.4) + re-vendored the bundle (lock normalized proxy→registry; lk + run-tests.sh excluded as project-owned / intentionally-divergent).
• Drift guard extended to the common root kit files; header documents the npm-install-not-surgical-edit rule.

Consort-only; pins scm-utils 0.3.4. Full BDD suite green (4629 passed).