release: v2.5.0 — Sign of Life

## Checklist

### Pre-release
- [ ] Merge dependabot security PRs (#70, #72, #73, #75, #76, #110)
- [ ] Review + merge PR #124 (API key auth) — or defer to v2.6.0
- [ ] Merge toolchain PRs (#127, chore/modernize-toolchain)
- [ ] Merge proto schema PR (feat/proto-schema)
- [ ] Tighten `files` field in package.json (exclude examples, source from npm tarball)
- [ ] Bump version to `2.5.0` in package.json files
- [ ] Write CHANGELOG.md
- [ ] Run full test suite: `pnpm test`
- [ ] Build and verify npm tarball: `pnpm pack`

### Apache Release Process
- [ ] Create signed release tarball (`apache-flagon-userale-2.5.0-src.tar.gz`)
- [ ] Upload RC to `dist/dev/flagon/`
- [ ] Call vote on `dev@flagon.apache.org` (72-hour minimum)
- [ ] Record vote result
- [ ] Move tarball to `dist/release/flagon/`
- [ ] Publish to npm: `npm publish`
- [ ] Tag `v2.5.0` on master
- [ ] Create GitHub release with changelog

### Post-release
- [ ] Announce on `dev@flagon.apache.org`
- [ ] Close this milestone

## Context

First release since v2.4.0 (May 2024). Includes the TypeScript migration, security fixes, toolchain modernization, and proto schema definition. 38+ commits unreleased.

Start with the checklist in this issue, then inspect package.json, the listed pull requests, and the Apache release process. Run pnpm test and pnpm pack after the prerequisite changes; done means the signed source release is voted on and published to the listed locations, npm, and GitHub with its changelog.

Written by the indexing model from the issue text.