fix(ci): restore package-lock.json (deleted in da2ae95); chore: release v2.16.3

- restore root package-lock.json so CI's npm ci works again
- bump 2.16.3 (npm + python) — ships jev-auto System One routing
  (single-pass option-attention engine, 97.8% distilled top-1, ~2ms)

Author: Das-rebel