v2.4.0

Release 2.4.0

Bumped with npm version, so package.json and both package-lock.json
entries move together. They had disagreed since 2.2.0, which edited one by
hand and left the lockfile saying 2.1.1 — and the lockfile travels inside
the artifact the release workflow ships.

Also writes down what a version number promises here, because 2.2.0 was
tagged locally and never pushed: the commits were live on main while
GitHub's latest release stayed 2.1.1 for eleven days. Pushing a branch and
pushing a tag are separate commands and only the second one releases.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com