Remediate production dependency audit failures blocking governance gates #149

Discovered while validating #148. This is pre-existing dependency debt; #148 adds no dependencies.

Current npm audit --audit-level=high --omit=dev reports production advisories including:

• @ai-sdk/provider-utils uncontrolled resource consumption
• @modelcontextprotocol/sdk OAuth credential-routing issue
• proxy-addr critical IPv4-mapped IPv6 trust-subnet spoofing
• related transitive ai / agents / @cloudflare/ai-chat paths

Governance Gates therefore fail before feature typecheck/tests can complete.

Required:

1. Resolve packages against current Cloudflare Agents/AI compatibility; do not force a breaking downgrade.
2. Regenerate lockfile.
3. Run npm audit --audit-level=high --omit=dev.
4. Run full typecheck/tests/workers tests.
5. Preserve the governance gate; do not suppress advisories.

Related validation blocker: #148.