chore(deps): comprehensive workspace dep update sweep

[jamestexas]

Summary

Workspace-wide dep update sweep across root + action + worker. Clears all 6 pnpm audit advisories (was 2 high / 4 moderate, all from transitive undici / ws).

Companion to the AIO consolidation work. notme.bot will inherit these deps after the B.1 lift; wrangler line aligned with notme.bot PR #2 (4.78 → 4.92).

Bumps taken

Workspace	Package	From	To
root	@vitest/coverage-v8	^4.1.2	^4.1.6
root	tsx	^4.21.0	^4.22.2
root	zod	^4.3.6	^4.4.3
root	pnpm.overrides undici	—	<6.24.0 → ^6.24.0
root	pnpm.overrides ws	—	<8.20.1 → ^8.20.1
action	@types/node	^25.5.0	^25.9.0
action	esbuild	^0.25.0	^0.25.12
action	typescript	^5.8.0	^5.9.3
worker	@cloudflare/workers-types	^4.20260329.1	^4.20260518.1
worker	@cloudflare/vitest-pool-workers	^0.13.5	0.13.5 (PIN)
worker	@playwright/test	^1.59.1	^1.60.0
worker	@types/node	^25.6.0	^25.9.0
worker	prettier	^3.8.1	^3.8.3
worker	vitest	^4.1.2	^4.1.6
worker	wrangler	^4.78.0	^4.92.0
worker	zod	^3.25.0	^4.4.3
worker	oslo	^1.2.1	REMOVED

Notable

• wrangler 4.78 → 4.92 — aligns with notme.bot PR sec(worker): extract /authorize redirect_uri validation + 16 tests #2 baseline; bumps Node baseline to 22. Wrangler 4.x changes are runtime-internal; no API surface change for our worker.
• zod 3 → 4 in worker — only one file (src/gha-oidc.ts) uses zod; it uses safeParse + .error.message, both stable across v3/v4. Root manifest was already on ^4.3.6; this aligns worker with root and avoids two zod copies in the lockfile.
• oslo removed — deprecated meta-package, zero imports under worker/src/. Worker already uses successor @oslojs/crypto + @oslojs/encoding directly.
• @cloudflare/vitest-pool-workers pinned to exact 0.13.5 (no caret) — per rosary-8ae6ab, 0.13.5 has the CF API 10375 issue but newer versions might too; pin makes the constraint explicit and prevents accidental lockfile drift.
• pnpm.overrides for undici / ws — clears all 5 undici advisories (transitive via @actions/http-client@2) and the ws advisory (transitive via miniflare). Lets us hold off on the @actions/* ESM-only majors.

Deferred (need code change or evidence — separate beads)

• @actions/core 1 → 3 / @actions/http-client 2 → 4 — both are ESM-only in their majors. Action is currently bundled by esbuild (which CAN consume ESM-only deps and emit a CJS bundle), but the migration warrants a focused PR with a smoke test on a real workflow run. Advisories handled via pnpm.overrides for now.
• @peculiar/x509 1 → 2 — security-sensitive. cert-authority.ts + signing-authority.ts use X509CertificateGenerator + extension classes; v2's API surface needs careful review against our cert format.
• typescript 5 → 6 (action only) — major TS bump warrants its own pass across the workspace, not bundled in deps sweep.
• esbuild 0.25 → 0.28 (action) — 0.x bumps frequently change defaults; worker is already at 0.28 line but keeping action at 0.25 to avoid bundling-flag drift in one PR.

Test plan

• pnpm install -r — clean
• pnpm audit — 0 advisories (was 2 high / 4 moderate)
• cd worker && pnpm test — 425 passed | 6 todo (28 files) — matches baseline
• task worker:check — typecheck + tests green
• task schema:check — green
• cd action && pnpm build — green; dist/index.js rebuilt + node --check clean
• CI to confirm worker deploy preview still green on this branch

Files

• package.json (root) — bumps + new pnpm.overrides
• action/package.json — devDep bumps
• worker/package.json — devDep + prod-dep bumps; oslo removed; zod major
• pnpm-lock.yaml — regenerated
• action/dist/index.js — rebuilt (GHA action ships pre-bundled JS; required so the deployed action picks up the bumped deps)

🤖 Generated with Claude Code