fix(deps): patch remaining Dependabot alerts and fold in open updates

.cspell/project-words.txt

@@ -20,6 +20,7 @@ BuildKit
 cgroup
 cobertura
 corepack
+cpqp
 cosign
 cspell
 CycloneDX

.github/workflows/codeql.yml

@@ -42,11 +42,11 @@ jobs:
         with:
           persist-credentials: false
       # github/codeql-action/init v4.38.2, reviewed 2026-10-06.
-      - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d
         with:
           languages: ${{ matrix.language }}
           build-mode: none
       # github/codeql-action/analyze v4.38.2, reviewed 2026-10-06.
-      - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/contract.yml

@@ -140,7 +140,7 @@ jobs:
         with:
           run_install: false
       # actions/setup-node v7, reviewed 2026-08-06.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
         with:
           node-version: 22.23.1
           cache: pnpm
@@ -197,7 +197,7 @@ jobs:
       # actions/upload-artifact v7, reviewed 2026-08-25.
       - name: Upload live B2 preflight evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: live-b2-preflight-isolation-cleanup
           path: reports/live-b2/preflight.json
@@ -247,7 +247,7 @@ jobs:
         with:
           run_install: false
       # actions/setup-node v7, reviewed 2026-08-06.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
         with:
           node-version: ${{ matrix.node-version }}
           cache: pnpm
@@ -396,7 +396,7 @@ jobs:
       # actions/upload-artifact v7, reviewed 2026-08-25.
       - name: Upload live B2 isolation and cleanup evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: live-b2-isolation-cleanup-node-${{ matrix.node-version }}
           path: reports/live-b2/isolation-cleanup-node-${{ matrix.node-version }}.json

.github/workflows/docs.yml

@@ -29,7 +29,7 @@ jobs:
         with:
           run_install: false
       # actions/setup-node v7, reviewed 2026-08-06.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
         with:
           node-version: 22.23.1
           cache: pnpm

.github/workflows/evals.yml

@@ -105,7 +105,7 @@ jobs:
         with:
           run_install: false
       # actions/setup-node v7, reviewed 2026-08-06.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
         with:
           node-version: 22.23.1
           cache: pnpm
@@ -143,7 +143,7 @@ jobs:
       # actions/upload-artifact v7, reviewed 2026-08-25.
       - name: Upload Claude pass-rate report
         if: ${{ always() && steps.validate_report.outcome == 'success' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: claude-pass-rate-report
           path: reports/evals/provider-pass-rates.json

.github/workflows/mutation.yml

@@ -42,7 +42,7 @@ jobs:
         with:
           run_install: false
       # actions/setup-node v7, reviewed 2026-08-06.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
         with:
           node-version: 22.23.1
           cache: pnpm
@@ -121,7 +121,7 @@ jobs:
       # actions/upload-artifact v7, reviewed 2026-08-25.
       - name: Upload mutation reports
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: mutation-reports
           path: |

.github/workflows/publish.yml

@@ -58,7 +58,7 @@ jobs:
       release-notes-sha256: ${{ steps.notes.outputs.release_notes_sha256 }}
     steps:
       # actions/download-artifact v8, reviewed 2026-08-25.
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           run-id: ${{ github.event.workflow_run.id }}
           name: release-tag-request
@@ -85,7 +85,7 @@ jobs:
         with:
           run_install: false
       # actions/setup-node v7, reviewed 2026-08-06.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
         with:
           node-version: 22.23.1
           registry-url: https://registry.npmjs.org
@@ -340,7 +340,7 @@ jobs:
           set -euo pipefail
           cp server.json publish-package/server.json
       # actions/upload-artifact v7, reviewed 2026-08-25.
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: npm-package
           path: |
@@ -382,13 +382,13 @@ jobs:
       contents: read # Read-only repository scope; preflight never writes.
     steps:
       # actions/download-artifact v8, reviewed 2026-08-25.
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           name: npm-package
           path: publish-package
       # Node 24.19.0 bundles the fetch/AbortController runtime used by release helpers.
       # actions/setup-node v7, reviewed 2026-08-06.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
         with:
           node-version: 24.19.0
           package-manager-cache: false
@@ -469,7 +469,7 @@ jobs:
           printf '%s  mcp-publisher-bin/mcp-publisher\n' "${MCP_PUBLISHER_BINARY_SHA256}" | sha256sum -c -
           chmod +x mcp-publisher-bin/mcp-publisher
       # actions/upload-artifact v7, reviewed 2026-08-25.
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: mcp-publisher
           path: mcp-publisher-bin/mcp-publisher
@@ -489,18 +489,18 @@ jobs:
       id-token: write # OIDC token for npm/registry publish provenance.
     steps:
       # actions/download-artifact v8, reviewed 2026-08-25.
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           name: npm-package
           path: publish-package
       # actions/download-artifact v8, reviewed 2026-08-25.
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           name: mcp-publisher
           path: mcp-publisher-bin
       # Node 24.19.0 bundles npm >=11.5.1, required for npm trusted publishing.
       # actions/setup-node v7, reviewed 2026-08-06.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
         with:
           node-version: 24.19.0
           registry-url: https://registry.npmjs.org
@@ -747,7 +747,7 @@ jobs:
       contents: write # Create the GitHub release and upload assets.
     steps:
       # actions/download-artifact v8, reviewed 2026-08-25.
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           name: npm-package
           path: publish-package

.github/workflows/release-tag.yml

@@ -50,7 +50,7 @@ jobs:
           printf '%s\n' "${REQUEST_TAG}" > release-request/tag.txt
           echo "Release publish requested for ${REQUEST_TAG}"
       # actions/upload-artifact v7, reviewed 2026-08-25.
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: release-tag-request
           path: release-request/tag.txt

.github/workflows/smoke.yml

@@ -118,7 +118,7 @@ jobs:
         with:
           run_install: false
       # actions/setup-node v7, reviewed 2026-08-06.
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1
         with:
           node-version: ${{ matrix.node-version }}
           cache: pnpm