chore(release): prepare v4.10.2

[kevintseng]

Refs #378. Prepares v4.10.2 (11 files, one commit).

What it does

• Version 4.10.1 to 4.10.2 in every anchor scripts/check-version-coherence.mjs reads: package.json and the lockfile's two version fields, both plugin manifests, the marketplace entry, herdr-plugin.toml, and the **Version**: lines of CODEMAP.md, docs/ARCHITECTURE.md and docs/api/API_REFERENCE.md.
• The version is not embedded in the built bundles, so the rebuild changes only two hashes in dist/skills-manifest.json (the two plugin manifests it covers).
• CHANGELOG.md: the unreleased entries move, unchanged, under ## [4.10.2]; an empty ## [Unreleased] heading stays above it. Two references in docs/ARCHITECTURE.md that pointed at the Unreleased entry now point at 4.10.2, and the sentence quoting the 402-file package list is scoped to the removal it describes (the package now has 407 files).

Release path (#378)

4.10.2 goes to the npm next tag first (the trial channel) and is promoted to latest only after at least a working day of observation. latest stays at 4.9.4 until then; 4.10.1 is not promoted, and once 4.10.2 is published next points at 4.10.2.

Merging this makes main declare a version with no tag; verify:release on main fails by design until the release is created (see scripts/lib/published-version.mjs). The release itself is made after the merge, from main, with the live-host receipts and the UI review for the merged commit. The maintainer waived the Codex live-host receipt for this trial release (the Codex account's usage limit runs to 2026-09-26); everything else runs as usual.

Evidence

• npm run build exit 0 (6 smoke tests); npm run verify green on the tip tree (tree c5936a83fdec); node scripts/check-version-coherence.mjs exit 0.
• Three independent reviewers (fresh-eyes, silent-failure, code review): no blocking finding. They checked every version anchor across the whole tree, recomputed all 35 manifest hashes (and regenerated the manifest byte for byte), confirmed the [4.10.2] section is byte-identical to the old unreleased content, and mapped every shipped change since v4.10.1 to a changelog entry (11 merges, no gaps). Their non-blocking findings that touch this diff (the two stale references, the 402-file sentence, the commit-message wording) are fixed in this commit; those small text fixes were not re-reviewed.
• Found by the review and filed separately, present in 4.10.1 too and not part of this change: MCP first-call update notice never fires for packaged installs (version read falls back to 0.0.0) #399 (the MCP first-call update notice never fires for packaged installs).