chore(deps): openai 7 — the floor it needs is already under it

[catomean]

Closes the fleet ratchet's last counted gap. The sweep held this believing prod ran the EOL system Node 20; the gateway actually runs its own nvm Node v22.22.3 — already over openai v7's only breaking change (Node ≥ 22 floor) — and the box's system Node is 24 now regardless. Production installs from npm-global, so this fork manifest change cannot touch the live gateway.

CI on this PR is the verification (the earlier #2 'no checks' was my premature merge, not absent CI). The security-audit lane is expected red from upstream's own transitive advisories — pre-existing on main, unrelated.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WqKqMnHQHSmkGFfc5t7Rxn

[github-actions]

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

• package.json
• pnpm-lock.yaml

Maintainer follow-up:

• Review whether the dependency changes are intentional.
• Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.
• Treat package-lock.json and npm-shrinkwrap.json diffs as security-review surfaces.
• Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

[github-actions]

Dependency graph changes noted

This PR includes dependency graph changes. The dependency guard is informational because the PR author is a repository admin or a member of @openclaw/openclaw-secops.

• Current SHA: fc4cde89a9cae893c116d3d181a9a7b571a41ba6
• Trusted actor: @catomean
• Trusted role: pull request author; repository admin

Security review is still recommended before merge when the dependency graph change is intentional.

[catomean]

Closing with a verdict rather than merging red: the bump itself is sound (gateway runs nvm Node 22.22.3 ≥ v7's floor; prod installs from npm-global, untouched by this manifest), but check-test-types fails on this PR with implicit-any/overload errors in the fork's own test files (session-write-lock.test.ts, commands-export-session.test.ts) — fork-baseline breakage (likely @types/node-26 interaction) that must be fixed before any dependency PR here can be CI-verified. Four more lanes (build-artifacts, check-shrinkwrap, checks-fast-bun-launcher, security-fast) are red on main itself. The fleet version-currency ratchet keeps this gap counted (baseline 1) until the fork's CI baseline is repaired.