Direct dependency vulnerabilities remain unpatched, and the SDK generator hides two contract violations

[Rwanbt]

Problem

bun audit reported 101 alerts on the branch. G6 in PROD_READINESS.md
records Dependabot as active but the triage as never done, and no dependency
PR has been merged.

The direct, patchable vulnerabilities need to be closed in isolated batches
with the lockfile, a typecheck and the affected package's tests each time —
not by a blind bun update.

Second, less obvious problem

Bumping @hey-api/openapi-ts changes the output the generator emits, so any
bump has to ship a regenerated packages/sdk or the sdk in sync with server
gate fails. packages/sdk/openapi.json itself does not change: only the
generator's reading of it does.

That new reading is stricter, and it exposes two real defects in code we
already ship:

1. RequestResult.response becomes optional, because a failure can happen
   before any response exists — while building the request, or on a network
   error. dialog-workspace-list.tsx dereferenced result.response.status
   with no guard, so a network error threw instead of surfacing an error.
2. The generator now propagates required-ness from the spec.
   openapi.json marks extra as required on experimental.workspace.create,
   and the TUI call site omitted it, so that call violated the server contract.
   The two call sites in team/opencode-application.ts already passed
   extra: null.

Both are pre-existing defects that the old generator's looser types concealed.