Bump version to 0.5.2

Rolls up post-0.5.1 security/UX changes:

- Auto-run preview-time checks: agent-side ABI decode + pair-consistency
  pre-sign hash recomputation now run unprompted at preview_send and
  report in a CHECKS PERFORMED block (PR #57, #59).
- Swiss-knife decoder URL surfaces as a Markdown hyperlink fallback when
  the agent's ABI decode is low-confidence (PR #59, #62).
- WalletConnect session-topic cross-check: get_ledger_status now returns
  the WC `topic`; the agent is instructed to surface its last 8 chars
  and ask the user to verify a matching session in Ledger Live →
  Settings → Connected Apps, catching peer impersonation that the
  self-reported name/URL pair can't (PR #61).
- Clear-sign vs blind-sign branching in on-device check reminders —
  Aave / Lido / 1inch / LiFi / approve flows check decoded fields, not
  a hash (PR #59 prose refinements).
- Agent-prompt notation fix: `{✓|✗|⚠}` placeholders instead of `[…]`
  so literal Markdown brackets + inline-code backticks survive the
  agent's paraphrase (PR #63).
- Integrator string reverted to "vaultpilot-mcp" on LiFi (PR #60).
- Plain-English "Why trust VaultPilot?" framing at top of SECURITY.md
  and mirrored in README Security model; security-critical error paths
  (payload-hash mismatch, previewToken mismatch, TRON device-address
  mismatch, unexpected signature shape) now carry a `SECURITY:` prefix
  and explicit "do NOT retry this handle — re-prepare from scratch"
  guidance so users know what to check.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: szhygulin

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "vaultpilot-mcp",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "mcpName": "io.github.szhygulin/vaultpilot-mcp",
   "description": "MCP server for AI agents (Claude Code, Claude Desktop, Cursor) to manage a self-custodial crypto portfolio through a Ledger hardware wallet. Reads on-chain wallet balances, ENS, token prices, and DeFi positions across Ethereum/Arbitrum/Polygon/Base (Aave V3, Compound V3, Morpho Blue, Uniswap V3 LP, Lido stETH, EigenLayer), surfaces liquidation/health-factor alerts and protocol risk scores, then prepares unsigned EVM transactions (supply, borrow, repay, withdraw, stake, unstake, native/ERC-20 send, and LiFi-routed swaps and cross-chain bridges) that the user signs on their Ledger device via WalletConnect — private keys never leave the hardware wallet.",
   "type": "module",

package.json

@@ -3,7 +3,7 @@
   "name": "io.github.szhygulin/vaultpilot-mcp",
   "title": "VaultPilot MCP",
   "description": "Self-custodial crypto portfolio: read EVM DeFi, sign on Ledger via WalletConnect.",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "websiteUrl": "https://github.com/szhygulin/vaultpilot-mcp",
   "repository": {
     "url": "https://github.com/szhygulin/vaultpilot-mcp",
@@ -14,7 +14,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "vaultpilot-mcp",
-      "version": "0.5.1",
+      "version": "0.5.2",
       "transport": { "type": "stdio" },
       "environmentVariables": [
         {