chore(release): 0.39.54

[pitimon]

PR Goal (one sentence)

Bump @ipv9/tokentracker-cli to 0.39.54 to release the vendor-rename normalizer + fuzzy-pricing disclosure fix (#193/#192, merged in #194) through npm.

Scope

• CLI (src/)
• Dashboard (dashboard/)
• Docs / CI / config

Checklist

• npm run ci:local passes
• New dashboard/user-facing strings go through copy.csv (N/A, already done in fix(pricing): general vendor-rename normalizer + fuzzy-pricing UI disclosure #194)
• Commits follow conventional style
• PR description explains why, not just what
• Version bump files are in lockstep (package.json, package-lock.json)
• npm publish state is recorded when release-bound: npm view @ipv9/tokentracker-cli version versions --json confirmed 0.39.53 is latest/immutable; publish handled via .github/workflows/npm-publish.yml on merge (falling back to the documented local-recovery path per release: migrate npm publication to Trusted Publishing OIDC #179 if CI OIDC still fails)

Why

Same pattern as #189: a source-only fix needs a version bump for npm-publish.yml to actually publish (it only fires when the on-disk package.json version is not yet on the registry).

Regression Test Gate

Verification method

• node --test test/npm-publish-workflow.test.js test/release-automation.test.js test/web-only-product-scope.test.js (per agent-os/standards/release/version-lockstep.md) → 24/24 pass
• npm run ci:local full gate → dashboard 320/320, product suite 1059/1059, all validators pass

Uncovered scope

• Live npm publish + registry smoke test happens after merge, not in this PR.