chore: prepare v0.3.4 release

[amavashev]

Summary

• bump the package and lockfile to 0.3.4
• consolidate the unpublished 0.3.2/0.3.3 changelog entries into the v0.3.4 release
• refresh the vendored runtime protocol fixture from v0.1.24 to v0.1.25.15 and align the exact ErrorCode contract assertion
• update test-only fast-uri from 3.1.2 to 3.1.4
• document the remaining evidence/JWKS and additive-mapping work as deferred to Spec-conformance audit: stale v0.1.24 fixture, dropped additive fields, closed enums #134

Why

npm and GitHub still publish v0.3.1, while main contains the EventCreateResponse.charged mapper fix plus additive TENANT_CLOSED, LIMIT_EXCEEDED, and Retry-After support. Versions 0.3.2 and 0.3.3 were never tagged or published, so v0.3.4 is the first coherent release after v0.3.1.

The fixture had remained on protocol v0.1.24 while the upstream spec had advanced to v0.1.25.15. The dependency lock also retained a vulnerable test-only fast-uri version.

Impact

This release fixes the missing effective event charge mapping and adds typed/retry-aware protocol handling without breaking the public API or wire format. The published package remains dependency-free.

Validation

• clean npm ci
• 339 tests passed, 5 skipped
• 98.61% statement / 99.81% line coverage
• lint passed
• typecheck passed
• build passed
• npm audit: zero vulnerabilities
• npm pack --dry-run: expected seven-file package, no bundled dependencies