v2.4.1 — every version carrier now agrees

Same-day patch on v2.4.0, from a cross-model review pass. v2.4.0 shipped three diverging versions at once: npm said 2.4.0, the MCP handshake advertised a hardcoded 2.3.0, and the MCPB manifest still said 2.2.0 — clients and Claude Desktop bundles each self-identified as older code.

• The server now reads its version from package.json at boot — the handshake can no longer go stale.
• build-mcpb.sh syncs the bundle manifest from package.json before packing; freshly built bundles self-identify correctly.
• A version-consistency test pins every carrier (package.json, server.json ×2, MCPB manifest, no hardcoded server literal), so the next added carrier must be registered there.
• The learn.ts docstring no longer describes the fuzzy-merge path removed in 2.4.0, and the legacy updated_similar test — which accepted either outcome — now pins the new contract: similar content is always added, the shorter original survives.

No functional changes beyond the advertised version. If you installed 2.4.0, the handshake reporting 2.3.0 was cosmetic — the fixes were active.