chore: sync package-lock.json + restore README.th.md parity

[kevintseng]

Summary

Two doc-sync fixes from the post-v4.2.6 /release-train pre-flight audit. No version bump.

• package-lock.json was stale at 4.1.4 even though all 7 other version anchors were on 4.2.6. Regenerated via npm install.
• README.th.md drifted from English canonical:
  • "## Upgrading" section missing (added in v4.2.5) → ported, three upgrade paths translated
  • "## บริจาค" (Donate) → renamed to correct "## การร่วมพัฒนา" (Contributing)
  • Install Option A / Option B sub-split was collapsed → restored two-option layout

After: TH ## heading count = 16, matches English exactly.

Docs synced

• CHANGELOG.md — not applicable (no version bump, no behavior change)
• docs/ARCHITECTURE.md — not applicable (no module changes)
• docs/api/API_REFERENCE.md — not applicable (no API surface change)
• README.md — not changed (this PR is a TH locale catch-up)
• README locales — TH brought back to parity with EN (16 vs 16 ## headings); other 9 locales were already in sync
• CLAUDE.md — not applicable (no module / hook / count change)
• Version files — not bumped (this is a post-release doc-sync, not a release)
• dist/skills-manifest.json — not regenerated (no source change in shipped files)
• memesh doctor — unaffected; package-lock.json is not in the publish files allow-list so npm tarball state is unchanged

Test plan

• node -p "require('./package-lock.json').version" → 4.2.6
• TH ## heading count = 16 (matches EN)
• No behavior change in shipped npm tarball (package-lock.json excluded from publish files)

[github-actions]

Multi-Model Synthesis

Both Claude and Codex reviews above are independent. The most
valuable signals are the issues only ONE model raised — those
are the blind spots single-model review misses.

Reviewer responsibility: read both, surface non-overlapping
findings, decide which need fixing before merge.