Ports #638 (based on the retired v1.4.x line) to v4/main. Same behavior, adapted to v4's file layout.

What changed

• New buildSdkBaseUserAgent(pkgData) in src/user-agent.mts builds the SDK's base UA as <name>/<version> node/<process.version> <os.platform()>/<os.arch()>.
• DEFAULT_USER_AGENT (src/constants.mts) now uses buildSdkBaseUserAgent instead of createUserAgentFromPkgJson.
• SocketSdk now appends a caller-supplied userAgent to the base rather than replacing it: `${DEFAULT_USER_AGENT} ${userAgent}`. So every request carries the SDK's own identifying token.
• createUserAgentFromPkgJson is unchanged (still builds a caller token with optional homepage) — it's the intended way to construct the token you pass as userAgent.

Example emitted header with a caller UA:

socketsecurity-sdk/4.0.4 node/v24.14.1 linux/arm64 socket/1.1.96 (https://github.com/SocketDev/socket-cli)

Tests

• test/repo/unit/user-agent.test.mts: new buildSdkBaseUserAgent suite asserts the default UA includes node/<version> and <platform>/<arch>, plus scoped-name normalization.
• test/repo/unit/getapi-sendapi-methods.test.mts: the existing custom-UA test now asserts the caller token is appended to the enriched base (was: replaced).

tsgo + lint green. Full unit suite green except the pre-existing resolveBasePath tests that assert the cwd path contains socket-sdk-js (they fail only in a /tmp worktree, unrelated to this change).