fix(deps): restore npm audit gate

[dudetru25]

What changed

• Remove the unused @modelcontextprotocol/sdk dependency and stale Hono override.
• Restore npm run audit to a strict full-tree audit.
• Resolve the approved vulnerable transitive versions through the existing VSCE toolchain, including brace-expansion@5.0.8.

Why

This removes the unused Hono-family dependency path and remediates the remaining npm/Dependabot resolutions without changing extension or standalone MCP runtime code.

Validation

• npm ci --no-audit --no-fund
• npm run compile
• npm run check:unused
• npm test — 205 passed, 0 failed
• npm run validate:vendor
• npm run audit — 0 vulnerabilities
• npm run validate
• VSIX packaging smoke test passed

The brace-expansion@5.0.8 release-age gate was bypassed only as the explicitly approved security hotfix for GHSA-mh99-v99m-4gvg (user approval: 2026-07-29). No broad exception was persisted.

Post-merge follow-up: verify the default-branch Dependabot rescan reports zero open alerts for unity-cursor-toolkit/package-lock.json (TASK-1).

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}