fix: drop ./ prefix from bin path so npm 11 keeps the executable

[nicosampler]

Summary

No related issue. The last publish attempt logged "bin[canton-barebones]" script name bin/canton-barebones.js was invalid and removed — npm 11 (now installed in release.yml for trusted publishing) strips bin entries whose path starts with ./ instead of just normalizing them like npm 10 did. Published like that, the package would ship without the canton-barebones command.

Changes

• Remove the ./ prefix from the bin path in package.json
• Add a patch changeset — this also exercises the full release flow end to end (changeset → Version Packages PR → publish via OIDC)

Acceptance criteria

• The next published version installs the canton-barebones executable (npx @bootnodedev/cbn --help works)
• No bin ... removed warning in the publish log

Test plan

Automated tests

No automated tests added; npm test runs as the publish gate in release.yml.

Manual verification

• Merge this PR → the bot opens the Version Packages PR bumping to 0.1.3
• Merge that PR → release.yml publishes via trusted publishing (OIDC)
• Verify: npm view @bootnodedev/cbn version shows 0.1.3 and npx @bootnodedev/cbn@latest status resolves the bin

Breaking changes

None.

Checklist

• Self-reviewed my own diff
• Tests added or updated
• Docs updated (if applicable)
• No unrelated changes bundled in

Screenshots

None.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.