The v0.96.0 bump (e8f4f6f8) touched package.json only; align the lockfile's
root version fields so npm ci in the publish worktree sees a consistent pair.