fix(manifest): rebind package-lock.json sha256 after ws CVE audit fix

The previous commit ran `npm audit fix` to resolve ws@7.x GHSA-96hv-2xvq-fx4p;
that rewrote integrity hashes inside package-lock.json, changing its sha256.
MANIFEST.json was not updated, so canonical-manifest.test.mjs failed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Parad0x-Labs

MANIFEST.json

@@ -137,7 +137,7 @@
     },
     {
       "path": "package-lock.json",
-      "sha256": "e60a4436cf352908b278edd4cdc31522554b0bf503c1c67dbd3fcc0495f7a859",
+      "sha256": "afc3b874fe17004b8ff402a334a57c59b3834affddedbf4e74e2f9b4850ba7aa",
       "size": 40389
     },
     {