Release GraphKeeper 0.1.3

[anusbutt]

Outcome

Prepare the verified graphkeeper@0.1.3 release candidate. This PR does not publish to npm, create a tag, or create a GitHub release.

Release contents

• align package, lockfile, CLI, README, and tests on version 0.1.3
• add CHANGELOG.md and include it in the npm package
• canonicalize the npm executable path
• make nested onboarding, pack, and install verification deterministic inside npm publish --dry-run
• require the clean tarball installation to report exact version 0.1.3

Verification

• clean WSL npm ci
• npm run release:verify: 247 functional/unit/integration/e2e/security tests and 2 isolated packaging tests passed
• explicit npm run test:security: 14 passed
• npm run test:performance: 5 passed; peak memory 57.35 MB
• npm ls --all: valid dependency tree
• exact tarball clean-install journey: --version, init, check, query, and doctor passed
• npm publish --dry-run --access public: passed; nothing published
• canonical-bin preview produced no npm metadata corrections

Final candidate tarball:

• filename: graphkeeper-0.1.3.tgz
• files: 57
• packed size: 51,170 bytes
• unpacked size: 218,244 bytes
• SHA-1: 9dcb264e9143a75f9e817bd62836dea82cbf39ce
• integrity: sha512-tJ2vtvovS83CKj/vFJqQmGG/L/rTpzpHOZhaS3Apej7b4hh3TvHWPgdiKwIbdqv6Yx0W/0gZ0Eyxsym315Hpog==

Publication boundary

The public package owner is anusbutt, but this environment currently returns E401 for npm whoami. After this PR is merged, authenticate npm explicitly and obtain a separate publish decision before publishing. Tagging and GitHub release creation must happen only after the registry package is verified.