REGRESSION, and it had been failing since the split. `npm test` on this line never built `dist/`,
because `pretest` exists on main and was never ported here. Two suites read `dist/` — the replay
manifest check and the static build — and the manifest check runs BEFORE the suite that happens to
build. So on a clean tree the run failed with "no replay manifest was built", and passed only on a
machine where something had already run `build:web`.
That is exactly a fresh clone and exactly CI, which is the worst place for it to hide: locally it
looked intermittent, because whether it passed depended on whether `dist/` happened to be lying
around from a deploy.
Verified by deleting `dist/` and running: fails without this change, 636/636 with it.
Also syncs `package-lock.json`'s version field, stale at 0.4.8 since before the 0.4.9 line began.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FLnYR4XtXQNamYJXGYT8oC
