Bumps `package.json` version `2026.5.18-boon.1` → `2026.5.18-boon.2`.

What boon.2 captures

• boon.1 — session-takeover hardening (PR 2026.5.18-boon.1 — session-takeover hardening #2, `a50a6b2`). Running on gandalf since 2026-05-29.
• + bundled Sentry monitor (PR feat(sentry-monitor): bundle Sentry error monitoring into the fork #4, `671cb6b`, merged 2026-06-02) — shipped-but-unversioned until now.

Base stays stock `2026.5.18`; this is not a rebase onto newer upstream.

Why

Cut a formal, installable release artifact (GitHub Release + `.tgz`) so the fleet rollout in ENG-12565 installs from a stable, auditable source instead of a hand-built dev-laptop tarball.

Merge gating

Do not merge until the boon.2 tarball is validated in-place on the internal canary (arief-openclaw-test, 4.23→5.18-boon.2). The GitHub Release is cut from the merge commit only after the canary is healthy.

Ref: ENG-12565. Single-line version bump; no code change.

Summary by cubic

Version bump to 2026.5.18-boon.2 to cut a formal, installable release for ENG-12565. No code changes.

• New Features

  • Bundled Sentry monitor included in the release.
  • Includes boon.1 session‑takeover hardening.
  • Base remains stock 2026.5.18 (no rebase).

• Migration

  • Validate the tarball on arief-openclaw-test (4.23→5.18-boon.2).
  • Merge only after the canary is healthy, then cut the GitHub Release.

^{Written for commit e76f5f4. Summary will update on new commits.}