chore: refresh dependencies

[steipete]

Summary

• refresh compatible Worker, UI, compiler, lint, build, and Wrangler dependencies
• update coder/websocket and pinned GitHub Actions
• retain pnpm 10.23.0 and oxfmt 0.54.0; their next versions are major/0.x behavior changes

Proof

• pnpm check
• pnpm test (733 tests)
• go test ./...
• pnpm macos:test (26 RoyalVNCKit + 78 CrabfleetMac tests)
• pnpm exec wrangler deploy --dry-run
• make docs-check
• actionlint
• pnpm audit --prod (0 advisories)
• govulncheck ./... (0 vulnerabilities)
• structured autoreview: clean, no actionable findings

No product behavior or release/version mutation is included.

[steipete]

Exact-head proof for ba6e76dc36ffc3cb4b1b9f26d162947f6b8c130a:

• pnpm check
• pnpm test: 733/733 passed
• go test ./...: all packages passed
• pnpm macos:test: 26 RoyalVNCKit and 78 CrabfleetMac tests passed
• pnpm exec wrangler deploy --dry-run: Worker assets, container image, bindings, and upload bundle built successfully
• make docs-check and actionlint: passed
• production pnpm audit: 0 advisories; govulncheck ./...: 0 vulnerabilities
• structured autoreview: clean, no actionable findings (0.78 confidence)
• hosted Go CLI check: green

Deferred deliberately: pnpm 11 (major), oxfmt 0.57 (0.x formatter behavior), transitive x/net until its current direct parent selects it, and the divergent CryptoSwift fork until focused live VNC validation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ba6e76dc36

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Refresh the release-age exception with the tsgo bump

In environments that set a nonzero pnpm minimumReleaseAge, this upgrade no longer has a matching exception: pnpm-workspace.yaml still exempts only @typescript/native-preview@7.0.0-dev.20260609.1 and the same-dated platform binaries. The pnpm 10 docs say minimumReleaseAge applies to all dependencies and exact-version minimumReleaseAgeExclude entries only exempt the listed versions, so installs that enforce the release-age policy can reject the new 20260701.1 tsgo packages; please update those exceptions or switch to a package-name/pattern exemption with this bump. https://pnpm.io/10.x/settings#minimumreleaseage

Useful? React with 👍 / 👎.