chore: pin the harperdb peer range to Harper 4 (<5.0.0)

[heskew]

The 1.x line is Harper 4-only. Its runtime assumptions don't hold on Harper 5 — e.g. request.session is the live hdb_session instance (with a working .delete()) on Harper 4, but a shallow copy (no .delete) on Harper 5. Constrain the peer range so 1.x can't be installed against Harper 5.

peerDependencies.harperdb: >=4.6.0 → >=4.6.0 <5.0.0.

Note: harperdb on npm tops out at 4.7.x (Harper 5 ships as the harper package), so this is explicit-intent / future-proofing rather than closing a live install path — but it documents the support boundary and guards against a future harperdb@5.

Base branch is v1.x.

[gemini-code-assist]

Code Review

This pull request updates the peer dependencies in package.json to restrict the harperdb version to be less than 5.0.0 (specifically, ">=4.6.0 <5.0.0"). There are no review comments, and I have no additional feedback to provide.

[github-actions]

3 blockers found.

1. Missing version bump

File: package.json:2
What: The PR introduces a change to the peerDependencies range on top of the v1.6.1 release (tag v1.6.1), but the version in package.json remains 1.6.1.
Why it matters: Since 1.6.1 has already been released and published to npm, this change cannot be deployed without a version increment (e.g., to 1.6.2). Attempting to publish with the same version will fail or create an immutable-metadata conflict.
Suggested fix: Bump the version to 1.6.2 in package.json.

2. Lockfile drift

File: package-lock.json
What: package.json was updated to include the <5.0.0 constraint on the harperdb peer dependency, but package-lock.json was not updated to reflect this metadata change in the root package entry.
Why it matters: Keeping the lockfile in sync with package.json is required for reproducible builds and to avoid npm ci failures or warnings in CI/CD pipelines.
Suggested fix: Run npm install (or npm install --package-lock-only) and commit the resulting changes to package-lock.json.

3. Missing CHANGELOG.md entry

File: CHANGELOG.md
What: This PR restricts the supported platform range for the 1.x maintenance line to exclude Harper 5, which is a notable change for integrators. However, no entry was added to the changelog.
Why it matters: Integrators rely on the changelog to understand compatibility changes. Without an entry, a user attempting to use this version with Harper 5 would encounter an undocumented installation failure.
Suggested fix: Add a new [1.6.2] or [Unreleased] section to CHANGELOG.md documenting the pinned peer dependency range under a "Changed" or "Fixed" heading.

---

4. Documentation drift (Internal)

File: CLAUDE.md:101
What: The CLAUDE.md file still lists the peer dependency as harperdb (>=4.6.0).
Why it matters: This internal guidance file for agents is now out of sync with the actual project constraints, which could lead to incorrect assumptions during future automated tasks.
Suggested fix: Update the peer dependency range in CLAUDE.md to match package.json (>=4.6.0 <5.0.0).

[heskew]

Review at 47c4bba: no blockers.

The peer range does what the PR intends: it includes supported Harper 4 releases from 4.6.0 and rejects 5.x. Consumers receive package.json, so the published compatibility boundary is effective.

Two low, non-blocking consistency cleanups:

• package-lock.json:29 still records the root peer as >=4.6.0. Please regenerate or edit the root lock metadata to match >=4.6.0 <5.0.0.
• CLAUDE.md still documents the peer as harperdb (>=4.6.0); please update it with the Harper-4 upper bound.

A version bump and changelog entry belong in the separate release PR, consistent with the repository workflow. The red review job is reviewer-action infrastructure; Node 22/24, Bun, lint/build/test, validation, and security checks are green.