fix(deps): restore production dependency safety

[rksharma-owg]

What changed

This follow-up to #119 restores the production dependency safety work in the repository:

• refreshes the lockfile to resolve patched versions of @modelcontextprotocol/sdk, @hono/node-server, express, body-parser, and fast-uri;
• raises the declared Node.js floor to 22.19.0 in both package metadata and the getting-started guide; and
• adds the explicit Error type required by the refreshed dependency graph under strict TypeScript checking.

The Node floor is intentional: the existing resolved undici@8.8.0 already declares >=22.19.0, and the suite reproduces runtime failures on Node 20. The new declaration makes the supported runtime honest rather than silently accepting an incompatible installation.

User impact

npm audit --omit=dev is clean, while the documented runtime now matches the dependency tree actually exercised by CI and local tests. There are no application behavior or public API changes.

Validation

• Node 22.19.0: npm run typecheck, npm test, and npm run build --silent all pass.
• Node 22.23.1: npm run lint passes with 0 errors (133 existing warnings), npm run typecheck passes, and all 675 tests pass.
• npm run test:coverage passes with 100% coverage on gated files.
• npm run doctor reports PASS (30/33 checks); the three warnings are optional local tools/services not present (semgrep, promptfoo, and the local API).
• npm run verify-claims passes 27/27.
• npm run test:no-fitting, npm run test:no-self-fitting, and npm run test:gate pass.
• npm run prompt:audit passes when invoked from a no-space symlink; its direct invocation in this workspace exposes a pre-existing URL-path decoding issue because the parent directory contains a space.
• npm run smoke reports 4 pass, 0 fail, and 4 expected skips because no local API or live LLM provider was running.
• npm audit --omit=dev --audit-level=moderate reports 0 vulnerabilities.

Contribution Receipt

• Change: Refresh vulnerable production dependency resolutions and align the declared Node.js minimum with the existing runtime dependency floor.
• Scope class: local_lab
• Target authority: not_applicable
• Network use: loopback for local runtime checks; npm registry access for dependency installation and audit metadata.
• Run mode labels: static_test, local_only
• Model/harness labels: model/provider not_applicable; agent runtime Codex; harnesses vitest, project verification scripts, TypeScript, and npm audit; tool access local_only; target class local_lab; run mode single_agent.
• Commands run:
  • npm run lint -> pass (0 errors; 133 existing warnings)
  • npm run typecheck -> pass
  • npm test -> pass (675/675)
  • npm run build --silent -> pass
  • npm run test:coverage -> pass
  • npm run doctor -> pass with 3 optional-tool/service warnings
  • npm run verify-claims -> pass (27/27)
  • npm run test:no-fitting -> pass
  • npm run test:no-self-fitting -> pass
  • npm run test:gate -> pass
  • npm run prompt:audit -> pass via a no-space symlink
  • npm run smoke -> pass (4 passed, 4 environment-dependent skips)
  • npm audit --omit=dev --audit-level=moderate -> pass (0 vulnerabilities)
  • npx --yes -p node@22.19.0 -c 'node --version; npm run typecheck; npm test; npm run build --silent' -> pass
• Artifacts: package-lock.json records the resolved dependency graph; test output was reviewed locally and is not committed.
• Redaction: No secrets, credentials, target data, or generated scan artifacts were produced.
• Claims changed: The supported Node.js version changes from 18+ to 22.19+ and is re-derived from undici@8.8.0's engine requirement plus a passing minimum-version validation run.
• Abstentions/refusals: 4 smoke checks skipped because no local API or live LLM provider was configured; no model attempts or refusals.
• Residual risk: A full development-dependency audit still reports two brace-expansion advisories in the ESLint toolchain. Resolving those currently requires an incompatible ESLint major upgrade, so this PR does not force it into the production-safety patch.