chore: sync package-lock.json to 0.9.5 (#440)

The 0.9.5 release bumped package.json but not package-lock.json — the
EUSAGE-on-npm-ci drift that #439's auto-sync workflow step now prevents
going forward. Fixing main retroactively so contributors and any
non-Release CI path see a consistent state.

Impact: zero on the published 0.9.5 release. The npm tarball ships
only npm-shim.js + package.json + README.md (no lock file), so end-user
installs are unaffected. The GitHub Release archives are platform-
bundled-Node tars from build-bundle.sh — also no lock file. Only fresh
git clones of main running 'npm ci' would have hit EUSAGE; this commit
fixes that.

Two-line diff: package-lock.json's top-level `version` and
`packages[''].version` both 0.9.4 → 0.9.5. No dependency changes.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>