chore: bump version to 0.5.0 (#36)

Version bump only — `package.json` and `package-lock.json`. Merge this,
then tag `v0.5.0` on `main` to trigger the release.

## What ships

One user-facing change since `v0.4.0`: the regenerated catalog from #18.

- `list_flows` gains `space_id` and `tag` query filters
- `include_scaling` is marked `deprecated`
- `list_artifact_approvals` is **removed** — the endpoint was retired
upstream

Everything else since `v0.4.0` is CI, docs, and repo hygiene, none of
which reaches the npm tarball. The README does ship, so the new beta
notice and write-action caution go out with this.

## Why minor, not patch

An action disappearing from the catalog is user-visible: anything
calling `list_artifact_approvals` via `execute_read_action` stops
resolving. Pre-1.0, a minor bump is the conventional signal for that,
even though the removal originated upstream rather than here.

## Notes

- `manifest.json` still holds its `0.0.0-replaced-at-build-time`
placeholder, injected by the pack script — untouched, as intended.
- Both `package.json` and `package-lock.json` were updated via `npm
version --no-git-tag-version`, so the lockfile doesn't drift.
- Tests pass locally: 8 files, 65 tests.
- This should be the first release carrying npm provenance, now that the
repo is public and #35 has landed. Verify after publish with `npm view
@kosli/mcp-server dist.attestations` — it returned `null` for 0.4.0.

Author: dangrondahl

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@kosli/mcp-server",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Model Context Protocol server for the Kosli API",
   "type": "module",
   "bin": {