chore(control): update patched Vite and Vitest dependencies to restore audit gates #326

Problem

Control's unchanged dependency lockfile now fails the existing npm audit --omit=dev CI gate. PR #325 exposed this during validation, but its CLI changes do not modify Control or dependency policy. A separate dependency-only change is needed; #266 covered an older, already-resolved source-map-js advisory and is not a duplicate of these newly published advisories.

Baseline: main at f19f2b5e9ac17d392375507bc753548cdfc0e751. Current locked versions include Vitest / @vitest/mocker 4.1.11 and Vite 7.3.6. Upstream advisories identify patched same-major versions 4.1.12 and 7.3.7 respectively. This reports dependency-audit exposure, not a reproduced production exploit or a claim that the deployed service has been tested.

References:

• Vitest manual mock registration advisory
• Vite filesystem allowlist advisory
• Observed CI failure

Scope and acceptance

• Reproduce the baseline audit and update only the affected dependency graph to compatible patched releases. Review transitive changes and keep the existing supported Node 22/24 contract.
• Preserve the production/development dependency boundary, registry integrity data and the existing audit/release gates. Do not suppress advisories, lower audit thresholds or use a forced major upgrade.
• Validate clean install, typecheck, build/tests and production/full dependency audits. Confirm current-head CI and automated review; independently review the proposed diff before opening the PR.
• Keep the change separate from feat(cli): explain delivery evidence across supported routes #325. No runtime feature, auth/security-policy, deployment, global installation, merge, release or package publication is authorized by this maintenance work.