chore(release): 0.3.3 stats validation hotfix

[bezata]

What this changes

Bumps the release-facing metadata from 0.3.2 to 0.3.3 in package.json, manifest.json, and server.json.

Adds the 0.3.3 changelog entry for the stats validation hotfix merged in #28.

This creates a user-visible release version change only after v0.3.3 is tagged.

Why

PR #28 fixed the notes.read stats validation failure and the stats.vault malformed frontmatter scan failure, but it did not change the package or registry metadata.

The release workflow only runs on v* tags. Since main still had 0.3.2 metadata, a v0.3.3 tag would have produced stale bundle metadata and npm would still see 0.3.2.

How

The release metadata is aligned at 0.3.3 across the npm package, MCP bundle manifest, and MCP registry server file.

The changelog documents the fixed notes.read output shape and the stats.vault skipped-note behavior.

What behavior is preserved

No runtime code changes are included here. The behavior fix remains the code already merged in #28.

Risk remains

After this PR merges, the release still requires pushing tag v0.3.3 so .github/workflows/release.yml can build bundles, create the GitHub release, run VirusTotal, and publish npm.

How reviewers can verify it

Local checks run:

bun run typecheck
bun run lint
bun run test
bun run build
git diff --check
node -e "const pkg=require('./package.json'); const manifest=require('./manifest.json'); const server=require('./server.json'); if (pkg.version!=='0.3.3'||manifest.version!=='0.3.3'||server.version!=='0.3.3'||server.packages[0].version!=='0.3.3') process.exit(1); console.log('versions aligned at 0.3.3');"