Vendor SDK v0.4.1, and stamp sdk-source.json while syncing

[marknolan]

Routine re-vendor after shimmer-web-sdk v0.4.1,
plus a defect in this repo's sync script that the sync exposed.

The re-vendor

Both copies move: the root vendor/, which every page and every module under
common/ imports, and shimmer-extension/vendor/, which is packed for the
store and cannot reach a copy outside itself.

v0.4.1 and not v0.4.0. The v0.4.0 artifact was built before its own version
bump, so its bundle reports SDK_VERSION = '0.3.0' — exactly the string
common/connect-ui.js prints at startup to say which build a page is running.
That release is now marked superseded; v0.4.1 has the same code with the release
ordering fixed (ShimmerResearch/shimmer-web-sdk#150).

Nothing in ShimmerCapture changes behaviour: it calls runDataRateTest, which
v0.4.1 did not touch. The runBleThroughputTest → runThroughputTest rename in
that release affects the Verisense client only, and the old name survives as a
deprecated alias regardless.

sync-local-sdk.ps1 never stamped sdk-source.json

It read the file for its sourceMode and left the version field alone, so
after a successful sync of a 0.4.x build the file still said 0.3.0 — while
AGENTS.md here ("Update with the scripts, never by hand — they stamp
sdk-source.json") and the SDK's own say the sync scripts stamp it.
verisense-device-console's copy of this script has always stamped. This is
that block ported across, comment and all, with its local-version and
local-latest exclusions intact: in those modes the field is the user's
selector, not provenance.

No page ever believed the stale field — connect-ui.js reads the version
from the bundle's own SDK_VERSION export, so what a page reports has always
been what it runs. That is why nothing surfaced this, and it is also why the fix
is provenance hygiene rather than a bug fix: the file should not claim a version
the vendored bundles are not.

Verification

Both vendored bundles and the extension's copy report SDK_VERSION = '0.4.1',
and sdk-source.json was stamped 0.4.1 by the script itself on this run, which
is what proves the ported block works.

🤖 Generated with Claude Code

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}