chore(release): npm publish readiness — stage v0.4.2

[Mlaz-code]

What

Stages the next npm release of @sharp-api/client. Main carries one unreleased API addition past v0.4.1 — the is_suspended / suspended_since EVOpportunity fields (#13) — but the version was never bumped, so cutting a release today would run npm publish at 0.4.1, which npm rejects (0.4.1 is already live, published 2026-06-04).

• Bump version 0.4.1 → 0.4.2 (patch — additive optional fields, same precedent as 0.3.1 / 0.4.1).
• CHANGELOG entry for 0.4.2 documenting the suspended-opportunity fields (inert until the server flag EV_SUSPENDED_STATE flips).
• Add engines: { node: ">=18" } — matches the Node 18/20/22 CI matrix; metadata only.

Readiness audit (all run on this branch)

• npm ci + npm run lint (biome) — clean
• npm run typecheck (tsc --noEmit) — clean
• npm run build (tsup) — ESM + CJS + .d.ts/.d.cts, matches the exports map
• npm pack --dry-run — 9 files, 33.3 kB: LICENSE, README, dist/{index.js,.cjs,+maps,+types}, package.json. No src, no .env; sourcemaps ship without sourcesContent (tsup strips it).
• Published 0.4.1 tarball diffed against a local build of main: the only API delta is the two new optional fields.

After merge, the release itself is one command (see #16 for the drafted notes):

gh release create v0.4.2 --title "v0.4.2 — suspended-opportunity state" --notes-file <notes>

publish.yml then gates on the Node 18/20/22 matrix (lint + tsc) and publishes with --provenance via NPM_TOKEN.

Refs #16
Type: chore