fix: refresh runtime dependency locks

[zbl1998-sdjn]

Summary

• Add an undici@8.5.0 override alongside the existing runtime protobufjs and ws overrides.
• Refresh package-lock.json; this moves @earendil-works/pi-coding-agent from 0.79.4 to 0.79.8 within the existing ^0.79.4 dependency range.
• Resolve the current high-severity production audit findings for undici, protobufjs, and ws.

Intent / impact

• No source code, CLI behavior, server behavior, route, config, or documentation changes.
• No change to the declared Node support range. I intentionally left that policy untouched; CI already runs on Node 22, and the Pi adapter already declares node >=22.19.0.
• Checked @earendil-works/pi-coding-agent package metadata from 0.79.4 to 0.79.8: main, types, exports, bin, and engines remain compatible for DevSpace's imports. The public type diff only adds exports and does not remove the tool factories DevSpace uses.

Verification

• npm ci --cache C:\tmp\npm-cache-devspace-pr --registry https://registry.npmjs.org
• npm run typecheck
• npm test
• npm run build (passes with the existing Vite chunk-size warning)
• npm audit --omit=dev --audit-level=high --cache C:\tmp\npm-cache-devspace-pr --registry https://registry.npmjs.org
• node dist/cli.js doctor
• npm pack --dry-run --cache C:\tmp\npm-cache-devspace-pr --registry https://registry.npmjs.org

[Copilot]

Pull request overview

This PR refreshes runtime dependency locks to address production npm audit findings, primarily by adding/pinning an undici override and updating the resolved versions in package-lock.json (including @earendil-works/pi-coding-agent within its existing semver range).

Changes:

• Add an undici@8.5.0 override alongside existing protobufjs and ws overrides.
• Regenerate package-lock.json, updating resolved versions (notably @earendil-works/pi-coding-agent 0.79.4 → 0.79.8).
• Pull in updated transitive dependencies associated with the lock refresh (e.g., protobufjs, ws, marked, @mistralai/mistralai).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Adds an undici override to pin a patched version for production audit findings.
package-lock.json	Refreshes the lockfile to resolve audit findings and update resolved/transitive dependency versions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.