Bug Receipt v1.4.1 — enforced version metadata

Version tracking guard

• adds metadata.version: "1.4.1" to the Agent Skill frontmatter;
• makes npm run skill:validate require semantic version x.y.z;
• makes validation fail when skill metadata and package.json versions differ.

This patch does not change the discovery description, skill instructions, receipt contract, or runtime behavior. The v1.4 robustness evidence therefore remains the applicable behavioral result.

Verification

• 33/33 tests passed
• full npm run check passed
• source and installed skills passed system quick_validate.py
• CI passed on Windows and Ubuntu with Node 20 and 22
• npm audit: 0 vulnerabilities