diff --git a/.github/actions/fleet/_shared/release-asset.mts b/.github/actions/fleet/_shared/release-asset.mts
new file mode 100644
index 000000000..e1f9283bb
--- /dev/null
+++ b/.github/actions/fleet/_shared/release-asset.mts
@@ -0,0 +1,172 @@
+const GITHUB_ORIGIN = 'https://github.com'
+
+export function integrityValue(integrity: unknown): string {
+  if (typeof integrity === 'object' && integrity !== null) {
+    const value = (integrity as { readonly value?: unknown | undefined }).value
+    return typeof value === 'string' ? value : ''
+  }
+  return typeof integrity === 'string' ? integrity : ''
+}
+
+export function integrityProvenance(integrity: unknown): {
+  readonly src: string
+  readonly date: string
+} {
+  if (typeof integrity === 'object' && integrity !== null) {
+    const record = integrity as {
+      readonly src?: unknown | undefined
+      readonly date?: unknown | undefined
+    }
+    return {
+      __proto__: null,
+      src: typeof record.src === 'string' ? record.src : '',
+      date: typeof record.date === 'string' ? record.date : '',
+    } as { readonly src: string; readonly date: string }
+  }
+  return { __proto__: null, src: '', date: '' } as {
+    readonly src: string
+    readonly date: string
+  }
+}
+
+function safeReleaseSegment(value: unknown, label: string): string {
+  if (
+    typeof value !== 'string' ||
+    value.length === 0 ||
+    value === '.' ||
+    value === '..' ||
+    /[/\\?#\u0000-\u0020]/u.test(value)
+  ) {
+    throw new Error(
+      `external-tools.json ${label} is not a safe GitHub release path segment`,
+    )
+  }
+  return value
+}
+
+function githubRepositorySlug(repository: unknown): string {
+  if (typeof repository !== 'string' || !repository.startsWith('github:')) {
+    throw new Error(
+      'external-tools.json repository is not a github:owner/repo reference',
+    )
+  }
+  const slug = repository.slice('github:'.length)
+  const parts = slug.split('/')
+  if (
+    parts.length !== 2 ||
+    !parts[0] ||
+    !parts[1] ||
+    parts.some(part => !/^[A-Za-z0-9_.-]+$/u.test(part))
+  ) {
+    throw new Error(
+      'external-tools.json repository is not a github:owner/repo reference',
+    )
+  }
+  return slug
+}
+
+export interface ReleaseAssetTool {
+  readonly origin?: unknown | undefined
+  readonly repository?: unknown | undefined
+  readonly tag?: unknown | undefined
+  readonly version?: unknown | undefined
+}
+
+export interface ReleaseAssetEntry {
+  readonly asset?: unknown | undefined
+  readonly integrity?: unknown | undefined
+}
+
+export interface ResolvedCatalogAsset {
+  readonly asset: string
+  readonly assetName?: string | undefined
+  readonly integrity: string
+  readonly repository?: string | undefined
+  readonly src: string
+  readonly date: string
+  readonly tag?: string | undefined
+  readonly version: string
+}
+
+/**
+ * Resolve a pinned GitHub release asset and verify its URL binding.
+ */
+export function resolveGithubReleaseAsset(
+  tool: ReleaseAssetTool,
+  entry: ReleaseAssetEntry,
+  canonicalKey: string,
+): ResolvedCatalogAsset {
+  const slug = githubRepositorySlug(tool.repository)
+  const tag = safeReleaseSegment(tool.tag, 'tag')
+  const assetName = safeReleaseSegment(entry.asset, 'platform asset')
+  const pathname = `/${slug}/releases/download/${encodeURIComponent(tag)}/${encodeURIComponent(assetName)}`
+  const asset = new URL(pathname, GITHUB_ORIGIN)
+  if (
+    asset.origin !== GITHUB_ORIGIN ||
+    asset.pathname !== pathname ||
+    asset.username ||
+    asset.password ||
+    asset.search ||
+    asset.hash
+  ) {
+    throw new Error(
+      `external-tools.json ${canonicalKey} release asset URL failed GitHub binding validation`,
+    )
+  }
+  const integrity = integrityValue(entry.integrity)
+  if (!integrity) {
+    throw new Error(
+      `external-tools.json ${canonicalKey} entry is missing integrity`,
+    )
+  }
+  const { src, date } = integrityProvenance(entry.integrity)
+  return {
+    __proto__: null,
+    asset: asset.href,
+    assetName,
+    integrity,
+    repository: slug,
+    src,
+    date,
+    tag,
+    version: String(tool.version ?? ''),
+  } as ResolvedCatalogAsset
+}
+
+/**
+ * Resolve a catalog asset while preserving its exact integrity metadata.
+ */
+export function resolveCatalogAsset(
+  tool: ReleaseAssetTool,
+  entry: ReleaseAssetEntry,
+  canonicalKey: string,
+): ResolvedCatalogAsset {
+  const isGithub =
+    tool.origin === 'gh-asset' ||
+    (typeof tool.repository === 'string' &&
+      tool.repository.startsWith('github:'))
+  if (isGithub) {
+    return resolveGithubReleaseAsset(tool, entry, canonicalKey)
+  }
+  const asset = entry.asset
+  const integrity = integrityValue(entry.integrity)
+  if (typeof asset !== 'string' || !asset.startsWith('https://')) {
+    throw new Error(
+      `external-tools.json ${canonicalKey} entry is missing an HTTPS asset URL`,
+    )
+  }
+  if (!integrity) {
+    throw new Error(
+      `external-tools.json ${canonicalKey} entry is missing integrity`,
+    )
+  }
+  const { src, date } = integrityProvenance(entry.integrity)
+  return {
+    __proto__: null,
+    asset,
+    integrity,
+    src,
+    date,
+    version: String(tool.version ?? ''),
+  } as ResolvedCatalogAsset
+}
diff --git a/.github/actions/fleet/_shared/resolve-external-tool-asset.generated.d.mts b/.github/actions/fleet/_shared/resolve-external-tool-asset.generated.d.mts
new file mode 100644
index 000000000..a54b9072b
--- /dev/null
+++ b/.github/actions/fleet/_shared/resolve-external-tool-asset.generated.d.mts
@@ -0,0 +1,56 @@
+/** Type declarations for the generated dependency-free release asset resolver. */
+
+export interface ReleaseAssetEntry {
+  readonly asset?: unknown
+  readonly integrity?: unknown
+}
+
+export interface ReleaseAssetTool {
+  readonly origin?: unknown
+  readonly repository?: unknown
+  readonly tag?: unknown
+  readonly version?: unknown
+}
+
+export interface PlatformEntry extends ReleaseAssetEntry {
+  readonly asset: string
+}
+
+export interface ResolvedCatalogAsset {
+  readonly asset: string
+  readonly assetName?: string
+  readonly integrity: string
+  readonly repository?: string
+  readonly src: string
+  readonly date: string
+  readonly tag?: string
+  readonly version: string
+}
+
+export const GO_OS_ARCH: Readonly<Record<string, { readonly os: string; readonly arch: string }>>
+export function canonicalPlatformKey(): string
+export function integrityProvenance(integrity: unknown): { readonly src: string; readonly date: string }
+export function integrityValue(integrity: unknown): string
+export function readVersionFromFile(file: string): string
+export function resolveCatalogAsset(
+  tool: ReleaseAssetTool,
+  entry: ReleaseAssetEntry,
+  canonicalKey: string,
+): ResolvedCatalogAsset
+export function resolveGithubReleaseAsset(
+  tool: ReleaseAssetTool,
+  entry: ReleaseAssetEntry,
+  canonicalKey: string,
+): ResolvedCatalogAsset
+export function resolveGoAssetFromManifest(
+  manifest: unknown,
+  version: string,
+  canonicalKey: string,
+): { readonly asset: string; readonly integrity: string; readonly version: string }
+export function resolvePlatformEntry(
+  platforms: Readonly<Record<string, PlatformEntry>>,
+  canonicalKey: string,
+): {
+  readonly entry: PlatformEntry | undefined
+  readonly fallbackKey: string | undefined
+}
diff --git a/.github/actions/fleet/_shared/resolve-external-tool-asset.mts b/.github/actions/fleet/_shared/resolve-external-tool-asset.mts
new file mode 100644
index 000000000..4f953a07b
--- /dev/null
+++ b/.github/actions/fleet/_shared/resolve-external-tool-asset.mts
@@ -0,0 +1,350 @@
+/**
+ * @file Resolve a pinned external-tool asset + SRI integrity for THIS runner,
+ *   from scripts/fleet/setup/external-tools.json. Replaces the curl-with-no-
+ *   checksum download dance repeated across setup-go-toolchain /
+ *   setup-rust-toolchain / setup-odai. Emits one JSON line on stdout:
+ *   {"asset":"<url>","integrity":"<sri>","version":"<v>"}
+ *   The caller passes `asset` + `integrity` to install-tool.mjs, which
+ *   downloads + SRI-verifies BEFORE extract/execute. Usage:
+ *   node resolve-external-tool-asset.generated.mjs --tool <name>
+ *   [--version <v>] [--version-file <path>] [--tools-file <path>]
+ *   [--platform-key <key>]
+ *   --version "stable" (or omitted) → the entry's pinned `version`.
+ *   --version-file → read a `go <version>` line (go.mod) and use that version.
+ *   For `go` ONLY, a version that differs from the pin is resolved live
+ *   against the go.dev release manifest (https://go.dev/dl/?mode=json) so a
+ *   custom Go version still gets a SHA-256-verified download; every other tool
+ *   requires the pinned version (the pin IS the integrity source). Exits 1 on
+ *   any resolution failure. A validated catalog with no asset for the selected
+ *   platform exits with PLATFORM_UNAVAILABLE_EXIT_CODE for optional callers.
+ *   Runs on the raw runner before setup-node (composite-action helper), so it
+ *   uses built-ins only (node:fs, node:path, node:process, fetch) — no
+ *   socket-lib, no node_modules.
+ *   Testability: the pure helpers (canonicalPlatformKey, resolvePlatformEntry,
+ *   integrityValue, readVersionFromFile, resolveGoAssetFromManifest) are
+ *   EXPORTED and the side-effectful CLI orchestration is guarded by
+ *   isMainModule(), so unit tests import them without triggering a network
+ *   fetch or a process.exit. Every composite-action _shared helper follows this
+ *   pattern (see check-fleet-shared-scripts-are-testable).
+ */
+
+import { existsSync, readFileSync, realpathSync } from 'node:fs'
+import process from 'node:process'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+import { integrityValue, resolveCatalogAsset } from './release-asset.mts'
+import type { ReleaseAssetTool } from './release-asset.mts'
+import {
+  canonicalPlatformKey,
+  readVersionFromFile,
+  resolveGoAssetFromManifest,
+  resolvePlatformEntry,
+} from './resolve-external-tool-platform.mts'
+import type { PlatformEntry } from './resolve-external-tool-platform.mts'
+
+export const PLATFORM_UNAVAILABLE_EXIT_CODE = 42
+
+export {
+  integrityProvenance,
+  integrityValue,
+  resolveCatalogAsset,
+  resolveGithubReleaseAsset,
+} from './release-asset.mts'
+export {
+  GO_OS_ARCH,
+  canonicalPlatformKey,
+  readVersionFromFile,
+  resolveGoAssetFromManifest,
+  resolvePlatformEntry,
+} from './resolve-external-tool-platform.mts'
+
+interface CatalogTool extends ReleaseAssetTool {
+  readonly manager?: unknown | undefined
+  readonly platforms?: Readonly<Record<string, PlatformEntry>> | undefined
+}
+
+interface ToolsCatalog {
+  readonly tools: Readonly<Record<string, CatalogTool>>
+  readonly toolsFile: string
+}
+
+function errorMessage(error: unknown): string {
+  if (error instanceof Error) {
+    return error.message || 'Unknown error'
+  }
+  if (error === null || error === undefined) {
+    return 'Unknown error'
+  }
+  const message = String(error)
+  if (message === '' || message === '[object Object]') {
+    return 'Unknown error'
+  }
+  return message
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+    return false
+  }
+  const prototype = Object.getPrototypeOf(value)
+  return prototype === null || prototype === Object.prototype
+}
+
+// Composite-action helper runs on the raw runner BEFORE setup-node finishes
+// resolving node_modules — @socketsecurity/lib-stable is not on disk yet, so
+// the logger.fail path the rest of the fleet uses is unavailable. Fall back to
+// a tiny inline fail that mirrors install-tool.mjs's bootstrap logger.
+function fail(msg: string): void {
+  // oxlint-disable-next-line socket/no-console-prefer-logger -- no lib yet
+  console.error(msg)
+}
+
+// Emit the resolver result as one JSON line on stdout (the caller reads it via
+// jq.mjs). Wrapped so the stream is reached inside a function, not at module
+// eval (not V8-snapshot-safe).
+function emit(obj: unknown): void {
+  // oxlint-disable-next-line socket/no-direct-stream-write -- dep-0
+  process.stdout.write(JSON.stringify(obj))
+}
+
+// ── CLI orchestration (guarded) ───────────────────────────────────────────
+
+function isMainModule(): boolean {
+  const entry = process.argv[1]
+  if (!entry) {
+    return false
+  }
+  try {
+    // realpath both sides before comparing. Node normalizes `..` in argv[1]
+    // but leaves symlinks in place, while import.meta.url is fully resolved, so
+    // a launch path under a symlinked prefix (macOS /tmp and /var/folders, a
+    // symlinked checkout) compares unequal and the CLI silently does nothing
+    // while exiting 0.
+    return pathToFileURL(realpathSync(entry)).href === import.meta.url
+  } catch {
+    return false
+  }
+}
+
+function argValue(name: string): string {
+  const i = process.argv.indexOf(name)
+  return i >= 0 && i + 1 < process.argv.length
+    ? (process.argv[i + 1] ?? '')
+    : ''
+}
+
+// The external-tools.json path and its parsed `tools` map. Every failure
+// here is terminal, so this exits rather than returning a verdict.
+function loadToolsCatalog(toolsFileArg: string): ToolsCatalog {
+  const toolsFile =
+    toolsFileArg ||
+    fileURLToPath(
+      new URL('../setup/external-tools.generated.json', import.meta.url),
+    )
+  if (!existsSync(toolsFile)) {
+    fail(`× external-tools.json not found at ${toolsFile}`)
+    process.exit(1)
+  }
+  let toolsData
+  try {
+    toolsData = JSON.parse(readFileSync(toolsFile, 'utf8'))
+  } catch (e) {
+    fail(`× could not parse ${toolsFile}: ${errorMessage(e)}`)
+    process.exit(1)
+  }
+  const tools = isPlainObject(toolsData) ? toolsData['tools'] : undefined
+  if (!isPlainObject(tools)) {
+    fail(`× ${toolsFile} has no valid tools map`)
+    process.exit(1)
+  }
+  return { __proto__: null, tools, toolsFile } as ToolsCatalog
+}
+
+// The named tool's catalog entry. A missing tool or a tool with no platforms
+// map is terminal.
+function selectToolEntry(
+  tools: Readonly<Record<string, CatalogTool>>,
+  toolName: string,
+  toolsFile: string,
+): CatalogTool {
+  const tool = tools[toolName]
+  if (!isPlainObject(tool)) {
+    fail(`× no '${toolName}' entry in ${toolsFile}`)
+    process.exit(1)
+  }
+  const platforms = tool['platforms']
+  if (!isPlainObject(platforms)) {
+    fail(`× '${toolName}' has no platforms map in ${toolsFile}`)
+    process.exit(1)
+  }
+  for (const [platformKey, entry] of Object.entries(platforms)) {
+    if (
+      !isPlainObject(entry) ||
+      typeof entry['asset'] !== 'string' ||
+      entry['asset'].length === 0 ||
+      !integrityValue(entry['integrity'])
+    ) {
+      fail(
+        `× '${toolName}' has a malformed ${platformKey} platform entry in ${toolsFile}`,
+      )
+      process.exit(1)
+    }
+  }
+  return tool as CatalogTool
+}
+
+// The version to install, in precedence order: the version file, then an
+// explicit non-`stable` argument, then the catalog pin. No version at all is
+// terminal.
+function resolveToolVersion({
+  tool,
+  toolName,
+  versionArg,
+  versionFile,
+}: {
+  readonly tool: CatalogTool
+  readonly toolName: string
+  readonly versionArg: string
+  readonly versionFile: string
+}): string {
+  const fileVersion = readVersionFromFile(versionFile)
+  let resolvedVersion = ''
+  if (fileVersion) {
+    resolvedVersion = fileVersion
+  } else if (versionArg && versionArg !== 'stable') {
+    resolvedVersion = versionArg
+  }
+  if (!resolvedVersion) {
+    resolvedVersion = typeof tool.version === 'string' ? tool.version : ''
+  }
+  if (!resolvedVersion) {
+    fail(`× no version resolved for '${toolName}' (no pin, no input)`)
+    process.exit(1)
+  }
+  const isGo = toolName === 'go' || tool.manager === 'go'
+  if (!isGo && resolvedVersion !== tool.version) {
+    fail(
+      `× '${toolName}' only accepts its pinned catalog version ${tool.version}`,
+    )
+    process.exit(1)
+  }
+  return resolvedVersion
+}
+
+// Emit the catalog entry's own asset + integrity. Forwards the object-form
+// provenance (src/date) so install-tool.mjs can run the live src + staleness
+// checks after the static SRI check. Empty for the string form (no
+// provenance) — install-tool.mjs no-ops them.
+function emitPinnedAsset(
+  tool: CatalogTool,
+  entry: PlatformEntry,
+  {
+    canonicalKey,
+    resolvedVersion,
+    toolsFile,
+  }: {
+    readonly canonicalKey: string
+    readonly resolvedVersion: string
+    readonly toolsFile: string
+  },
+): void {
+  try {
+    const resolved = resolveCatalogAsset(tool, entry, canonicalKey)
+    emit({ ...resolved, version: resolvedVersion })
+  } catch (error) {
+    fail(`× ${errorMessage(error)} in ${toolsFile}`)
+    process.exit(1)
+  }
+}
+
+// The go.dev release manifest, the integrity source for a `go` version that
+// is not the catalog pin. Any fetch failure is terminal.
+async function fetchGoDlManifest(): Promise<unknown> {
+  try {
+    // pre-setup-node helper: built-in fetch only.
+    // oxlint-disable-next-line socket/no-fetch-prefer-http-request -- bootstrap
+    const res = await fetch('https://go.dev/dl/?mode=json&include=all', {
+      redirect: 'follow',
+    })
+    if (!res.ok) {
+      fail(`× go.dev manifest fetch failed: HTTP ${res.status}`)
+      process.exit(1)
+    }
+    return await res.json()
+  } catch (e) {
+    fail(`× go.dev manifest fetch failed: ${errorMessage(e)}`)
+    process.exit(1)
+  }
+  return undefined
+}
+
+async function main(): Promise<void> {
+  const toolName = argValue('--tool')
+  const versionArg = argValue('--version')
+  const versionFile = argValue('--version-file')
+  const toolsFileArg = argValue('--tools-file')
+  const platformArg = argValue('--platform-key')
+
+  if (!toolName) {
+    fail(
+      'usage: resolve-external-tool-asset.generated.mjs --tool <name> [--version <v>] [--version-file <path>] [--tools-file <path>]',
+    )
+    process.exit(1)
+  }
+
+  const { tools, toolsFile } = loadToolsCatalog(toolsFileArg)
+  const tool = selectToolEntry(tools, toolName, toolsFile)
+
+  const canonicalKey = platformArg || canonicalPlatformKey()
+
+  const { entry, fallbackKey } = resolvePlatformEntry(
+    tool.platforms!,
+    canonicalKey,
+  )
+  if (fallbackKey) {
+    fail(
+      `· ${toolName}: no ${canonicalKey} asset, falling back to ${fallbackKey} (statically linked, runs on musl)`,
+    )
+  }
+  if (!entry) {
+    fail(
+      `× '${toolName}' has no platform asset for ${canonicalKey} in ${toolsFile}`,
+    )
+    process.exit(PLATFORM_UNAVAILABLE_EXIT_CODE)
+  }
+
+  const resolvedVersion = resolveToolVersion({
+    tool,
+    toolName,
+    versionArg,
+    versionFile,
+  })
+
+  // Pinned-version fast path: emit the entry's asset + integrity. A version
+  // override on `go` is resolved live against go.dev below; every other tool
+  // requires the pinned version (the pin IS the integrity source).
+  const isGo = toolName === 'go' || tool.manager === 'go'
+  const pinVersion = tool.version || ''
+  if (!isGo || resolvedVersion === pinVersion) {
+    emitPinnedAsset(tool, entry, {
+      canonicalKey,
+      resolvedVersion,
+      toolsFile,
+    })
+    return
+  }
+
+  // go custom-version path: resolve the SHA-256 from the go.dev manifest.
+  const manifest = await fetchGoDlManifest()
+
+  try {
+    emit(resolveGoAssetFromManifest(manifest, resolvedVersion, canonicalKey))
+  } catch (e) {
+    fail(`× ${errorMessage(e)}`)
+    process.exit(1)
+  }
+}
+
+if (isMainModule()) {
+  void main()
+}
diff --git a/.github/actions/fleet/_shared/resolve-external-tool-platform.mts b/.github/actions/fleet/_shared/resolve-external-tool-platform.mts
new file mode 100644
index 000000000..42183d4c5
--- /dev/null
+++ b/.github/actions/fleet/_shared/resolve-external-tool-platform.mts
@@ -0,0 +1,185 @@
+import { existsSync, readdirSync, readFileSync } from 'node:fs'
+import process from 'node:process'
+
+import type { ReleaseAssetEntry } from './release-asset.mts'
+
+export type PlatformEntry = ReleaseAssetEntry & { readonly asset: string }
+
+interface GoOsArch {
+  readonly arch: string
+  readonly os: string
+}
+
+type PlatformKey = `${string}-${string}`
+
+interface GoManifestFile {
+  readonly arch?: string | undefined
+  readonly filename?: string | undefined
+  readonly kind?: string | undefined
+  readonly os?: string | undefined
+  readonly sha256?: string | undefined
+}
+
+interface GoManifestRelease {
+  readonly files?: readonly GoManifestFile[] | undefined
+  readonly stable?: boolean | undefined
+  readonly version?: string | undefined
+}
+
+// Canonical → Go os/arch. Go ships no musl tarball — the glibc archive is
+// statically linked and runs on musl too, so musl keys map to the glibc
+// os/arch. Exported so the resolver and tests can assert the mapping.
+export const GO_OS_ARCH = {
+  __proto__: null,
+  'darwin-arm64': { os: 'darwin', arch: 'arm64' },
+  'darwin-x64': { os: 'darwin', arch: 'amd64' },
+  'linux-arm64': { os: 'linux', arch: 'arm64' },
+  'linux-arm64-musl': { os: 'linux', arch: 'arm64' },
+  'linux-x64': { os: 'linux', arch: 'amd64' },
+  'linux-x64-musl': { os: 'linux', arch: 'amd64' },
+  'win32-arm64': { os: 'windows', arch: 'arm64' },
+  'win32-x64': { os: 'windows', arch: 'amd64' },
+} as unknown as Readonly<Partial<Record<PlatformKey, GoOsArch>>>
+
+// Return the canonical Socket platform key for this runner.
+export function canonicalPlatformKey(): string {
+  const archMap = {
+    __proto__: null,
+    arm64: 'arm64',
+    x64: 'x64',
+  } as unknown as Readonly<Record<string, string>>
+  const arch = archMap[process.arch]
+  if (!arch) {
+    throw new Error(`unsupported arch: ${process.arch}`)
+  }
+  let platform
+  if (process.platform === 'darwin') {
+    platform = 'darwin'
+  } else if (process.platform === 'linux') {
+    platform = 'linux'
+  } else if (process.platform === 'win32') {
+    platform = 'win32'
+  } else {
+    throw new Error(`unsupported platform: ${process.platform}`)
+  }
+  let suffix = ''
+  if (platform === 'linux') {
+    const report = process.report?.getReport?.() as
+      | {
+          readonly header?:
+            | { readonly glibcVersionRuntime?: unknown | undefined }
+            | undefined
+        }
+      | undefined
+    const libc = report?.header?.glibcVersionRuntime
+    if (libc === 'musl') {
+      suffix = '-musl'
+    } else if (!libc) {
+      const isMusl = ['/lib', '/lib64'].some(directory => {
+        if (!existsSync(directory)) {
+          return false
+        }
+        try {
+          return readdirSync(directory).some(file =>
+            file.startsWith('ld-musl-'),
+          )
+        } catch {
+          return false
+        }
+      })
+      if (isMusl) {
+        suffix = '-musl'
+      }
+    }
+  }
+  return `${platform}-${arch}${suffix}`
+}
+
+export function resolvePlatformEntry(
+  platforms: Readonly<Partial<Record<PlatformKey, PlatformEntry>>>,
+  canonicalKey: string,
+): {
+  readonly entry: PlatformEntry | undefined
+  readonly fallbackKey: string | undefined
+} {
+  const entry = platforms[canonicalKey as PlatformKey]
+  if (entry) {
+    return { __proto__: null, entry, fallbackKey: undefined } as {
+      readonly entry: PlatformEntry | undefined
+      readonly fallbackKey: string | undefined
+    }
+  }
+  if (canonicalKey.endsWith('-musl')) {
+    const glibcKey = canonicalKey.slice(0, -5)
+    const fallback = platforms[glibcKey as PlatformKey]
+    if (fallback) {
+      return { __proto__: null, entry: fallback, fallbackKey: glibcKey } as {
+        readonly entry: PlatformEntry | undefined
+        readonly fallbackKey: string | undefined
+      }
+    }
+  }
+  return { __proto__: null, entry: undefined, fallbackKey: undefined } as {
+    readonly entry: PlatformEntry | undefined
+    readonly fallbackKey: string | undefined
+  }
+}
+
+export function readVersionFromFile(file: string): string {
+  if (!file || !existsSync(file)) {
+    return ''
+  }
+  const src = readFileSync(file, 'utf8')
+  // oxlint-disable-next-line socket/require-regex-comment -- go.mod directive
+  const match = /^go\s+(\d+\.\d+(?:\.\d+)?)/m.exec(src)
+  return match?.[1] ?? ''
+}
+
+export function resolveGoAssetFromManifest(
+  manifest: unknown,
+  version: string,
+  canonicalKey: string,
+): {
+  readonly asset: string
+  readonly integrity: string
+  readonly version: string
+} {
+  const goOsArch = GO_OS_ARCH[canonicalKey as PlatformKey]
+  if (!goOsArch) {
+    throw new Error(`go: no os/arch mapping for ${canonicalKey}`)
+  }
+  const want = `go${version}`
+  const release = Array.isArray(manifest)
+    ? (manifest as readonly GoManifestRelease[]).find(
+        item => item.version === want && item.stable,
+      )
+    : undefined
+  if (!release) {
+    throw new Error(
+      `go.dev manifest has no stable release '${want}' (resolved version ${version})`,
+    )
+  }
+  const file = Array.isArray(release.files)
+    ? release.files.find(
+        item =>
+          item.os === goOsArch.os &&
+          item.arch === goOsArch.arch &&
+          item.kind === 'archive',
+      )
+    : undefined
+  if (!file || !file.sha256 || !file.filename) {
+    throw new Error(
+      `go.dev release ${want} has no archive for ${goOsArch.os}-${goOsArch.arch}`,
+    )
+  }
+  return {
+    __proto__: null,
+    asset: `https://go.dev/dl/${file.filename}`,
+    integrity: `sha256-${file.sha256}`,
+    version: String(version),
+  } as {
+    readonly asset: string
+    readonly integrity: string
+    readonly version: string
+  }
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 08236e61b..9ba1b448f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -165,8 +165,8 @@ settings:
 catalogs:
   default:
     '@anthropic-ai/claude-code':
-      specifier: 2.1.251
-      version: 2.1.251
+      specifier: 2.1.272
+      version: 2.1.272
     '@babel/core':
       specifier: 7.29.7
       version: 7.29.7
@@ -210,8 +210,8 @@ catalogs:
       specifier: 2.2.5
       version: 2.2.5
     '@mdn/browser-compat-data':
-      specifier: 8.1.0
-      version: 8.1.0
+      specifier: 8.1.1
+      version: 8.1.1
     '@modelcontextprotocol/client':
       specifier: 2.0.0
       version: 2.0.0
@@ -246,11 +246,11 @@ catalogs:
       specifier: 1001.1.10
       version: 1001.1.10
     '@pnpm/lockfile.detect-dep-types':
-      specifier: 1100.0.21
-      version: 1100.0.21
+      specifier: 1100.0.23
+      version: 1100.0.23
     '@pnpm/lockfile.fs':
-      specifier: 1100.2.5
-      version: 1100.2.5
+      specifier: 1100.2.7
+      version: 1100.2.7
     '@pnpm/logger':
       specifier: 1100.0.0
       version: 1100.0.0
@@ -348,8 +348,8 @@ catalogs:
       specifier: 1.27.0
       version: 1.27.0
     browserslist:
-      specifier: 4.28.8
-      version: 4.28.8
+      specifier: 4.28.9
+      version: 4.28.9
     c8:
       specifier: 12.0.0
       version: 12.0.0
@@ -363,8 +363,8 @@ catalogs:
       specifier: 7.0.0
       version: 7.0.0
     compromise:
-      specifier: 14.16.0
-      version: 14.16.0
+      specifier: 14.17.0
+      version: 14.17.0
     cross-env:
       specifier: 10.1.0
       version: 10.1.0
@@ -375,11 +375,11 @@ catalogs:
       specifier: 2.0.0
       version: 2.0.0
     ecc-agentshield:
-      specifier: 1.4.0
-      version: 1.4.0
+      specifier: 1.6.0
+      version: 1.6.0
     fast-check:
-      specifier: 4.9.0
-      version: 4.9.0
+      specifier: 4.10.0
+      version: 4.10.0
     fast-glob:
       specifier: 3.3.3
       version: 3.3.3
@@ -390,8 +390,8 @@ catalogs:
       specifier: 1.2.0
       version: 1.2.0
     ignore:
-      specifier: 7.0.7
-      version: 7.0.7
+      specifier: 7.0.9
+      version: 7.0.9
     js-yaml:
       specifier: npm:@zkochan/js-yaml@0.0.10
       version: 0.0.10
@@ -459,8 +459,8 @@ catalogs:
       specifier: 8.0.1
       version: 8.0.1
     pastoralist:
-      specifier: 1.13.0
-      version: 1.13.0
+      specifier: 1.13.2
+      version: 1.13.2
     playwright-core:
       specifier: 1.63.0
       version: 1.63.0
@@ -513,8 +513,8 @@ catalogs:
       specifier: 2.1.3
       version: 2.1.3
     zod:
-      specifier: 4.5.4
-      version: 4.5.4
+      specifier: 4.6.5
+      version: 4.6.5
 
 overrides:
   '@polka/url': 1.0.0-next.29
@@ -524,7 +524,7 @@ overrides:
   '@socketsecurity/registry': 2.0.5
   '@socketsecurity/sdk': 4.1.4
   '@swc/core': 1.16.1
-  brace-expansion@>=4: 5.0.9
+  brace-expansion@>=4: 5.0.12
   chalk@>=5: 5.6.2
   es-define-property: npm:@socketregistry/es-define-property@1.0.7
   es-set-tostringtag: npm:@socketregistry/es-set-tostringtag@1.0.10
@@ -536,9 +536,9 @@ overrides:
   hasown: npm:@socketregistry/hasown@1.0.7
   iconv-lite: 0.7.3
   isexe@>=3: 4.0.0
-  js-yaml@>=5.0.0 <5.2.2: 5.4.1
+  js-yaml@>=5.0.0 <5.2.2: 5.4.2
   lru-cache@>=10: 11.5.2
-  magic-string: 1.2.3
+  magic-string: 1.4.1
   mime-db: 1.54.0
   mime-types@>=3: 3.0.2
   minimatch@>=3: 10.2.6
@@ -551,13 +551,13 @@ overrides:
   ssri@>=12: 13.0.1
   string-width@>=5: 8.2.2
   tinyexec: 1.3.1
-  typebox: 1.3.30
+  typebox: 1.3.31
   undici@<6: 6.28.0
   update-notifier@>=4.0.0: 7.3.1
   uuid: 11.1.1
   which: 7.0.0
   wrap-ansi@>=8: 9.0.2
-  yaml@2: 2.9.0
+  yaml@2: 2.9.1
   '@grpc/proto-loader': 0.8.1
   '@octokit/graphql': 9.0.5
   '@octokit/request-error': 7.1.2
@@ -572,8 +572,8 @@ overrides:
   '@types/unist@2': 3.0.3
   aggregate-error: npm:@socketregistry/aggregate-error@^1.0.15
   ansi-regex: 6.3.0
-  ast-v8-to-istanbul: 1.0.5
-  brace-expansion: 5.0.9
+  ast-v8-to-istanbul: 1.0.6
+  brace-expansion: 5.0.12
   color-convert: 2.0.1
   commander: 11.1.0
   content-type: 2.1.0
@@ -581,28 +581,28 @@ overrides:
   defu: '>=6.1.7'
   emoji-regex: 10.6.0
   execa: 10.0.1
-  fast-uri: '>=4.1.3'
+  fast-uri: '>=4.1.5'
   form-data: '>=4.0.6'
   globalthis: npm:@socketregistry/globalthis@^1.0.8
   graceful-fs: 4.2.11
   has-property-descriptors: npm:@socketregistry/has-property-descriptors@^1.0.7
   has-proto: npm:@socketregistry/has-proto@^1.0.7
-  hono: '>=4.13.5'
+  hono: '>=4.13.8'
   https-proxy-agent: 7.0.6
   indent-string: npm:@socketregistry/indent-string@^1.0.14
-  ip-address: '>=10.7.0'
+  ip-address: '>=10.7.1'
   is-core-module: npm:@socketregistry/is-core-module@^1.0.11
   is-interactive: npm:@socketregistry/is-interactive@1.0.6
   is-unicode-supported: npm:@socketregistry/is-unicode-supported@1.0.5
   isarray: npm:@socketregistry/isarray@^1.0.8
   json-stable-stringify: npm:@socketregistry/json-stable-stringify@1.0.14
   lodash: 4.18.1
-  markdown-it: 14.3.1
+  markdown-it: 14.3.2
   npm-package-arg: 13.0.2
   packageurl-js: npm:@socketregistry/packageurl-js@^1.5.0
   path-parse: npm:@socketregistry/path-parse@^1.0.8
   picomatch: 4.0.7
-  postcss: '>=8.5.26'
+  postcss: '>=8.5.28'
   protobufjs: 7.6.6
   qs: '>=6.16.0'
   rolldown: 1.2.9
@@ -618,12 +618,12 @@ overrides:
   tar: '>=7.5.22'
   tiny-colors: 2.2.2
   typedarray: npm:@socketregistry/typedarray@^1.0.8
-  undici: 6.28.0
-  vite: 8.2.2
+  undici: 6.28.1
+  vite: 8.3.0
   which@>=4: 7.0.0
   wrap-ansi: 9.0.2
   xml2js: 0.6.2
-  yaml: 2.9.0
+  yaml: 2.9.1
   yargs-parser: 21.1.1
 
 patchedDependencies:
@@ -631,7 +631,6 @@ patchedDependencies:
   '@polka/url@1.0.0-next.29': 60d82e95c5e67e66c41fe2987ddd4fc3f4992f12158e5c56838e7682e6ef72ea
   '@sigstore/sign@5.0.0': 4d806e50e530edf6761bba8ad98cd1f2867a86201f6faee419444d86f5325def
   '@sindresorhus/df@5.0.0': 47c1e44703106ab3c1bd7111ca44b18012c52fd1bba00a4aa89c4d38fefa0ab1
-  brace-expansion@5.0.9: a89e05a7c781115d8e78a92c9f9b843aa7c534a587baa5ac808074d4fafa6857
   minimatch@10.2.6: 83f1ea5b333d1b6fe1b36f93ccb222aa02e5dd468b2c646e285d7d53d234e174
   mount-point@3.0.0: 9c49adac71f1f6a01c4c1805853bc101d834fab7d990fc9f100257ffc2190ca3
   node-gyp@12.4.0: 140ba43d43d74f7d3577feb3f8a6efad544dbb0059784102b144a0e2daa437f9
@@ -645,7 +644,7 @@ importers:
     devDependencies:
       '@anthropic-ai/claude-code':
         specifier: 'catalog:'
-        version: 2.1.251
+        version: 2.1.272
       '@babel/core':
         specifier: 'catalog:'
         version: 7.29.7(supports-color@7.2.0)
@@ -690,7 +689,7 @@ importers:
         version: 2.2.5
       '@mdn/browser-compat-data':
         specifier: 'catalog:'
-        version: 8.1.0
+        version: 8.1.1
       '@modelcontextprotocol/client':
         specifier: 'catalog:'
         version: 2.0.0
@@ -699,7 +698,7 @@ importers:
         version: 2.0.0
       '@modelcontextprotocol/node':
         specifier: 'catalog:'
-        version: 2.0.0(@modelcontextprotocol/server@2.0.0)(hono@4.13.5)
+        version: 2.0.0(@modelcontextprotocol/server@2.0.0)(hono@4.13.8)
       '@modelcontextprotocol/server':
         specifier: 'catalog:'
         version: 2.0.0
@@ -732,10 +731,10 @@ importers:
         version: 1001.1.10
       '@pnpm/lockfile.detect-dep-types':
         specifier: 'catalog:'
-        version: 1100.0.21
+        version: 1100.0.23
       '@pnpm/lockfile.fs':
         specifier: 'catalog:'
-        version: 1100.2.5(@pnpm/logger@1100.0.0)
+        version: 1100.2.7(@pnpm/logger@1100.0.0)
       '@pnpm/logger':
         specifier: 'catalog:'
         version: 1100.0.0
@@ -846,7 +845,7 @@ importers:
         version: 5.0.0(vitest@5.0.0)
       '@vitiate/core':
         specifier: 'catalog:'
-        version: 0.3.1(typescript@7.1.0-dev.20260904.1)(vite@8.2.2(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))(vitest@5.0.0)
+        version: 0.3.1(typescript@7.1.0-dev.20260904.1)(vite@8.3.0(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.1))(vitest@5.0.0)
       '@yarnpkg/parsers':
         specifier: 'catalog:'
         version: 3.1.0
@@ -860,17 +859,17 @@ importers:
         specifier: 6.3.0
         version: 6.3.0
       ast-v8-to-istanbul:
-        specifier: 1.0.5
-        version: 1.0.5
+        specifier: 1.0.6
+        version: 1.0.6
       ata-validator:
         specifier: 'catalog:'
-        version: 1.27.0(yaml@2.9.0)
+        version: 1.27.0(yaml@2.9.1)
       brace-expansion:
-        specifier: 5.0.9
-        version: 5.0.9(patch_hash=a89e05a7c781115d8e78a92c9f9b843aa7c534a587baa5ac808074d4fafa6857)
+        specifier: 5.0.12
+        version: 5.0.12
       browserslist:
         specifier: 'catalog:'
-        version: 4.28.8
+        version: 4.28.9
       c8:
         specifier: 'catalog:'
         version: 12.0.0
@@ -885,7 +884,7 @@ importers:
         version: 7.0.0
       compromise:
         specifier: 'catalog:'
-        version: 14.16.0
+        version: 14.17.0
       cross-env:
         specifier: 'catalog:'
         version: 10.1.0
@@ -897,13 +896,13 @@ importers:
         version: 2.0.0
       ecc-agentshield:
         specifier: 'catalog:'
-        version: 1.4.0
+        version: 1.6.0
       emoji-regex:
         specifier: 10.6.0
         version: 10.6.0
       fast-check:
         specifier: 'catalog:'
-        version: 4.9.0
+        version: 4.10.0
       fast-glob:
         specifier: 'catalog:'
         version: 3.3.3
@@ -921,7 +920,7 @@ importers:
         version: 7.0.6(supports-color@7.2.0)
       ignore:
         specifier: 'catalog:'
-        version: 7.0.7
+        version: 7.0.9
       js-yaml:
         specifier: 'catalog:'
         version: '@zkochan/js-yaml@0.0.10'
@@ -932,14 +931,14 @@ importers:
         specifier: 'catalog:'
         version: 11.5.2
       magic-string:
-        specifier: 1.2.3
-        version: 1.2.3
+        specifier: 1.4.1
+        version: 1.4.1
       markdownlint-cli2:
         specifier: 'catalog:'
         version: 0.23.2(supports-color@7.2.0)
       mcp-tada:
         specifier: 'catalog:'
-        version: 0.4.0(@modelcontextprotocol/client@2.0.0)(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.5.4))(typescript@7.1.0-dev.20260904.1)
+        version: 0.4.0(@modelcontextprotocol/client@2.0.0)(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.6.5))(typescript@7.1.0-dev.20260904.1)
       mdast-util-from-markdown:
         specifier: 'catalog:'
         version: 2.0.3(supports-color@7.2.0)
@@ -996,7 +995,7 @@ importers:
         version: 8.0.1
       pastoralist:
         specifier: 'catalog:'
-        version: 1.13.0
+        version: 1.13.2
       playwright-core:
         specifier: 'catalog:'
         version: 1.63.0
@@ -1046,8 +1045,8 @@ importers:
         specifier: 'catalog:'
         version: 2.30.1(typescript@7.1.0-dev.20260904.1)
       typebox:
-        specifier: 1.3.30
-        version: 1.3.30
+        specifier: 1.3.31
+        version: 1.3.31
       typescript:
         specifier: 'catalog:'
         version: 7.1.0-dev.20260904.1
@@ -1056,13 +1055,13 @@ importers:
         version: 0.1.0
       vitest:
         specifier: 'catalog:'
-        version: 5.0.0(patch_hash=555bbde80f3e83833e33f6825435e36659d4e2a927e2a3cb5dbc4d6eaeef976b)(@types/node@26.5.1)(@vitest/coverage-v8@5.0.0)(@vitest/ui@5.0.0)(vite@8.2.2(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+        version: 5.0.0(patch_hash=555bbde80f3e83833e33f6825435e36659d4e2a927e2a3cb5dbc4d6eaeef976b)(@types/node@26.5.1)(@vitest/coverage-v8@5.0.0)(@vitest/ui@5.0.0)(vite@8.3.0(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.1))
       vitiate:
         specifier: 'catalog:'
-        version: 0.3.1(typescript@7.1.0-dev.20260904.1)(vite@8.2.2(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))(vitest@5.0.0)
+        version: 0.3.1(typescript@7.1.0-dev.20260904.1)(vite@8.3.0(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.1))(vitest@5.0.0)
       yaml:
-        specifier: 2.9.0
-        version: 2.9.0
+        specifier: 2.9.1
+        version: 2.9.1
       yargs-parser:
         specifier: 21.1.1
         version: 21.1.1
@@ -1071,7 +1070,7 @@ importers:
         version: 2.1.3
       zod:
         specifier: 'catalog:'
-        version: 4.5.4
+        version: 4.6.5
 
   .claude/hooks/fleet/account-snapshot-recorder:
     devDependencies:
@@ -2035,7 +2034,7 @@ importers:
     dependencies:
       compromise:
         specifier: 'catalog:'
-        version: 14.16.0
+        version: 14.17.0
     devDependencies:
       '@types/node':
         specifier: 'catalog:'
@@ -4555,52 +4554,52 @@ packages:
     engines: {node: '>=20.19.0'}
     hasBin: true
 
-  '@anthropic-ai/claude-code-darwin-arm64@2.1.251':
-    resolution: {integrity: sha512-Qr5oMGVrOUyatsMlK0361OSnr3C785QBFIDoaiHMpaJ/nu/Ji2ccwI7nv0o54q3v3Y+zU9xbtEmcGxPRcR9ptA==}
+  '@anthropic-ai/claude-code-darwin-arm64@2.1.272':
+    resolution: {integrity: sha512-l3CI1gPSCGkWNbAnX66SbDF4uFBecCCLu9FLN43JSbMMds5cb6tjOTBMSTr1ydZRZALW9AC/PYabtQOgXIbK5Q==}
     cpu: [arm64]
     os: [darwin]
 
-  '@anthropic-ai/claude-code-darwin-x64@2.1.251':
-    resolution: {integrity: sha512-wDMj6uELqU/uUeXH3E+32R9Gyx6pxdffBmjCbP8CoGGN0VufEd88vXhIGK2P0XIsksSh3fJZdxS00EaQSpHYPw==}
+  '@anthropic-ai/claude-code-darwin-x64@2.1.272':
+    resolution: {integrity: sha512-ejcezmomY6iSZFd9O5ScyrHGx3iAjSn17pR0SxSzGAC2gDgMYT3dpNS2ZXzXwrfAEJE+5lIQATb8h4jW7iDZwA==}
     cpu: [x64]
     os: [darwin]
 
-  '@anthropic-ai/claude-code-linux-arm64-musl@2.1.251':
-    resolution: {integrity: sha512-VJAZGuGTaRQINdUS35qhkgZoK8R+0MciPHMG6KMTFHjLC8GKtxj47RmiWcCUAu+fJpEOsko0FLEBqvAbdOpkJg==}
+  '@anthropic-ai/claude-code-linux-arm64-musl@2.1.272':
+    resolution: {integrity: sha512-3SfM9knufvP00l8uzpbwSDt70Tfv+oEIG8C/YLqXmLdIlkixhQGKe9rAIpDYlThx5NI4pO52D7kh+qWozhhwDg==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@anthropic-ai/claude-code-linux-arm64@2.1.251':
-    resolution: {integrity: sha512-h4EXRyV25yJfez40cTIoBlJptJqccP8nIDPdDMO9TDPUzZ6e5Y3OO9AgrfdMRAgccaTRsKfJenh7lA2D40nzdw==}
+  '@anthropic-ai/claude-code-linux-arm64@2.1.272':
+    resolution: {integrity: sha512-tpUGL+bDziPYaBplXrR018NdSE191nNvQGDHv9QluLB7u4h3t4iRSVnZ8e2KVJerAkER7JeS76sdRGoMPRSIfA==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@anthropic-ai/claude-code-linux-x64-musl@2.1.251':
-    resolution: {integrity: sha512-fuELyER/KyDie/iPimqHgZauPINBb+mWoYG7dXKxaxXlqCSmSI9YHzDVQ/1zSfiUnAU3FhbT1p9GNBqwJPikqA==}
+  '@anthropic-ai/claude-code-linux-x64-musl@2.1.272':
+    resolution: {integrity: sha512-IeQVPCIUbD7EOk5o5FZQNJ7Om08+oDev5SlajdW3IuWMgqPhIg0etiYYMeHyuuNY0+/kpFiatxLdV7+HqPzWgw==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@anthropic-ai/claude-code-linux-x64@2.1.251':
-    resolution: {integrity: sha512-HJyCY1ynzlsBk+N02IJeBNNZmzyd43lMuff49IXtbUDGHlf2XFHcxwYJEWCwIW51J3Hl4MvrqM6Ye8PGpJRIiA==}
+  '@anthropic-ai/claude-code-linux-x64@2.1.272':
+    resolution: {integrity: sha512-QXxOsStovQPz5+hWTQMK7yb4YZFT2mXhu4ejF4nCXHcsbBEBq/jfLWr9SNJCdD4NjD9o4XxjJrDrrdKOM1Kw8g==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@anthropic-ai/claude-code-win32-arm64@2.1.251':
-    resolution: {integrity: sha512-6hkf7WoAk74WJuQ/epE+GKy5SJ7RU7kcpy3PRFHt6E1tiYNscihfZY1TMQ+AMQsDo1iFQFHbGITR95+vr3at+w==}
+  '@anthropic-ai/claude-code-win32-arm64@2.1.272':
+    resolution: {integrity: sha512-rA3f1OoVE3bAuzoIrNzyYilg1KXa1aRjt1N0xLL15mLap8Hz/vaLWFeendS3gxThbTWORTGU9FzXcEzhsCz4Cg==}
     cpu: [arm64]
     os: [win32]
 
-  '@anthropic-ai/claude-code-win32-x64@2.1.251':
-    resolution: {integrity: sha512-fVXAvS2lCMJWD/lcyzzai5pcDQnlldGl8pwyGQ2vBxcuF8LS/7nVDqLOqTZsoAJ+VDKnlkPlPOJytDQEhTHHMQ==}
+  '@anthropic-ai/claude-code-win32-x64@2.1.272':
+    resolution: {integrity: sha512-vIPhBSceF/crQSrLSlozGz+n52q8MOb3aqYc20h0mwoQ+5pWBkW6oyyq0vLANDUSduT2Z33PKkru2vl/KkoWGQ==}
     cpu: [x64]
     os: [win32]
 
-  '@anthropic-ai/claude-code@2.1.251':
-    resolution: {integrity: sha512-eG+ZPPpW2Dbmnntf1Fz9/T9ewS8I8SKfc1tcU2PqSwmftfjRPP7BXPaCyLuZ8kvgTdiPnJi/2/JnTvTRieneEQ==}
+  '@anthropic-ai/claude-code@2.1.272':
+    resolution: {integrity: sha512-sOwHBM69H8Zka3/D3rc2VNNemPYNlgfYTdhsoqPoXZdK5KcKQlzoue4asJ2RVc+tGb/Pz1qxjVV9nVJQ87W7Ng==}
     engines: {node: '>=22.0.0'}
     hasBin: true
 
@@ -5034,7 +5033,7 @@ packages:
     resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==}
     engines: {node: '>=18.14.1'}
     peerDependencies:
-      hono: '>=4.13.5'
+      hono: '>=4.13.8'
 
   '@iarna/toml@2.2.5':
     resolution: {integrity: sha512-trnsAYxU3xnS1gPHPyU961coFyLkh4gAD/0zQ5mymY4yOZ+CYvsPqUbOFSw0aDM4y0tV7tiFxL/1XfXPNC6IPg==}
@@ -5063,14 +5062,17 @@ packages:
   '@jridgewell/sourcemap-codec@1.5.5':
     resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
 
+  '@jridgewell/sourcemap-codec@1.6.0':
+    resolution: {integrity: sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==}
+
   '@jridgewell/trace-mapping@0.3.31':
     resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
 
   '@js-sdsl/ordered-map@4.4.2':
     resolution: {integrity: sha512-iUKgm52T8HOE/makSxjqoWhe95ZJA1/G1sYsGev2JDKUSS14KAgg1LHb+Ba+IPow0xflbnSkOsZcO08C7w1gYw==}
 
-  '@mdn/browser-compat-data@8.1.0':
-    resolution: {integrity: sha512-BNlUjp+9O6gtIHPVZEGFb5rgtuWW8weR+mSKfLOevxbfoZv5DRe3N4ZTEpXiIm5wfR7+kqHu8malCCgP6USrlg==}
+  '@mdn/browser-compat-data@8.1.1':
+    resolution: {integrity: sha512-RARbe5H5WrOTJAUGzUP8FfYFqOwpthrMVU8Ma/MC8mi+twRw9LU2ndk6axbxAK1TNYNWM2JM2FwRQgHJWNVMBg==}
 
   '@modelcontextprotocol/client@2.0.0':
     resolution: {integrity: sha512-8f1OghQ2rjzIOfqgUCP+8GiUWqRs89njoWLNqAe8kWmDePv3s1fZXseej+QXemssEuuOvLLmLO/kqM3IQHtISw==}
@@ -5085,7 +5087,7 @@ packages:
     engines: {node: '>=20'}
     peerDependencies:
       '@modelcontextprotocol/server': ^2.0.0
-      hono: '>=4.13.5'
+      hono: '>=4.13.8'
     peerDependenciesMeta:
       hono:
         optional: true
@@ -5575,12 +5577,12 @@ packages:
     resolution: {integrity: sha512-W8pLZvXWLlGG5p0Z2nCvtBhlM6uuTcbAbsS15wlGS31jBBJKJW2udLoFeM7qfWPo7E2PqRPGxca7APpVYAjJhw==}
     engines: {node: '>=18.12'}
 
-  '@pnpm/crypto.hash@1100.0.3':
-    resolution: {integrity: sha512-D/r2SCheFvxkfsh8uE0uWfkTPbJfdbinXkkAmjhIIl3irwB4cu31zd2P2/9mD0GQxM0SllqHAoDFKF43a9IWQw==}
+  '@pnpm/crypto.hash@1100.0.4':
+    resolution: {integrity: sha512-88jKAtBFnPtc2Yv9mkeqenr65ADpYgp3zhSMPnjR8F9DYoN1iuDeA2RTeFZ7gE/jWqSn9cuo/dt6PyRlYY9snA==}
     engines: {node: '>=22.13'}
 
-  '@pnpm/crypto.integrity@1100.0.5':
-    resolution: {integrity: sha512-oJTyynvTG258IGrAUqo9ERtdwCwccc0uDtKQPFp3dO+1pCrnw/c0GpZjSkJm5rzGt5gRz42u9FX46k9D6TOtKw==}
+  '@pnpm/crypto.integrity@1100.0.6':
+    resolution: {integrity: sha512-4DZlkVBefPZJNbYIomW0jvc2Bi9jALAAuuLVujRVltBETITVbOEMwWmtt5wIg/Urxfva9+tcKcrm+m8lSAEZVQ==}
     engines: {node: '>=22.13'}
 
   '@pnpm/crypto.polyfill@1000.1.0':
@@ -5591,50 +5593,50 @@ packages:
     resolution: {integrity: sha512-PNImtV2SmNTDpLi4HdN86tJPmsOeIxm4VhmxgBVsMrJPEBfkNEWFcflR3wU6XVn/26g9qWdvlNHaawtCjeB93Q==}
     engines: {node: '>=18.12'}
 
-  '@pnpm/deps.path@1101.0.1':
-    resolution: {integrity: sha512-h69tuysbcaCtTcGsySUksufCF73QUPS5Xfr146D1+KGXNFtd7QEHt5soWfismm7s/aU7jIBLTS8RUvvE7p4i5Q==}
+  '@pnpm/deps.path@1101.0.2':
+    resolution: {integrity: sha512-GvCMGFw0V88CSQmV9SasgrzODYCeBXaJj2+kD6/1gfaW+irrVJMKHHUprdn+Ti4snB78pTAn1y2sFe+ablGHTg==}
     engines: {node: '>=22.13'}
 
-  '@pnpm/error@1100.1.3':
-    resolution: {integrity: sha512-YwnVAPxkVCzKksIqnMn+EmiM186KWPAnVwqp+ro5Y2N4b4nhvdzYSfbO6OM4Is9z/EC1qOA6rF63QQ+z4DVjgw==}
+  '@pnpm/error@1100.1.4':
+    resolution: {integrity: sha512-u7sHXD1yw5TDE2lxCnee95WPnBTuqHQvmOVJzy7GLEkju3kSBOiHvCARe7mlDoxvN/HBOKUFyMJtcEgn+OSUDA==}
     engines: {node: '>=22.13'}
 
   '@pnpm/fetching.fetcher-base@1100.2.9':
     resolution: {integrity: sha512-7F9NzEhfGWslB09gM0u7pBpEFKznrYQSUQRixSqTLxwd7NfT6ZeKTKWcaQydWuqZ9xcfMSYAVbRz36tlRa6Jpw==}
     engines: {node: '>=22.13'}
 
-  '@pnpm/fs.graceful-fs@1100.2.0':
-    resolution: {integrity: sha512-B66Gh2+U3gQtX84/SXHg+QLWk4FOSYI/jDBE8a0SYyGMDmEVNGL8hP5IWsFNrTFOYjBQgCzuIbnCDDzXi2GYHA==}
+  '@pnpm/fs.graceful-fs@1100.2.1':
+    resolution: {integrity: sha512-pP8pAiE3tW0VC5O44puq2KQWYUHoUrLJVdA1IDhTKvhP/lZD0DNDyWq59tXdN1eADY3BiZO8X5vwWLSmae2UyQ==}
     engines: {node: '>=22.13'}
 
   '@pnpm/graceful-fs@1000.1.0':
     resolution: {integrity: sha512-EsMX4slK0qJN2AR0/AYohY5m0HQNYGMNe+jhN74O994zp22/WbX+PbkIKyw3UQn39yQm2+z6SgwklDxbeapsmQ==}
     engines: {node: '>=18.12'}
 
-  '@pnpm/hooks.types@1101.0.1':
-    resolution: {integrity: sha512-QWQpq5dMBkT+hIlKCCVawgHKjQCXGRK3M9UH1THHNPc36eSrBOh6MbPW2/1rgAoyCQfUrquiLgeXxI5NOKLTCA==}
+  '@pnpm/hooks.types@1101.0.2':
+    resolution: {integrity: sha512-VeTXMt9KGLBl/YmM2Wn2NH0Bp7NjwDd7+XskLgQpzcfi6+otQOdUrk64+EVljZe/fTAXpC32D+Y2KWk0FKF4gw==}
     engines: {node: '>=22.13'}
 
-  '@pnpm/lockfile.detect-dep-types@1100.0.21':
-    resolution: {integrity: sha512-ey1s5MEW1iS9kCO3VvxBcEJYApTQlhQEkfiPpi9k+LOo56+CwSpTfAz9lPqPwdaB6mwZ8KZ4icpDsebRhl0aVA==}
+  '@pnpm/lockfile.detect-dep-types@1100.0.23':
+    resolution: {integrity: sha512-5jXMpOakjYM5KGe4wdzDW2DLuMbe9CyQ8z38sN9dVmkfy7J8fR0KQ7e/7NXThYEHWcLo+vG+3p4Ym4z13BktGA==}
     engines: {node: '>=22.13'}
 
-  '@pnpm/lockfile.fs@1100.2.5':
-    resolution: {integrity: sha512-P/xNbctw2zqkvjuCqMizTQXPyMUIlsiL8pz2OPAJqsj0PdE94mxODZ72FDengdiIt6arPy8Bd5AmWkBOHQ/Etg==}
+  '@pnpm/lockfile.fs@1100.2.7':
+    resolution: {integrity: sha512-1JxI0vReksQm2txqOg3+S0Geav9rPzEJZ/FDaF8p25/QecKZ+4EfvB9vYeVPU7NdF0ILCAkF+SrZP94rLaE/1A==}
     engines: {node: '>=22.13'}
     peerDependencies:
       '@pnpm/logger': ^1100.0.0
 
-  '@pnpm/lockfile.merger@1100.0.21':
-    resolution: {integrity: sha512-4EMLOFvgduv+3hBgxzdjsg0OdskJCb4FOAMwChX0gKWIaaC9y5T7bR45n90geLsP+4OzaJNfISsIpUku0rekUg==}
+  '@pnpm/lockfile.merger@1100.0.22':
+    resolution: {integrity: sha512-4A3lU7hiKfYc/tX1jgxIINIJZfEyLz5/Hc66DgqBXbTEYcYLMY40ROU0Z754XUID9TKHbyy2d19OP/IYc4YOWA==}
     engines: {node: '>=22.13'}
 
-  '@pnpm/lockfile.types@1100.1.0':
-    resolution: {integrity: sha512-guSNUjcP73XUvJjM+w8oN86R+h1gXtIte2b7SNxK5jaQtck+CHkwSzV77yOGKWyq+UcuQIzsI7956gf/XnnddA==}
+  '@pnpm/lockfile.types@1100.1.1':
+    resolution: {integrity: sha512-HrxJJVuZeRrHXUL+3v0xVpw4pFi0/3ETRgoYm/OMJDeyR56dRbuNlW/UhbEhsAc9fYEjKh8akhJPAAlssp5SAA==}
     engines: {node: '>=22.13'}
 
-  '@pnpm/lockfile.utils@1102.1.0':
-    resolution: {integrity: sha512-zj2RNA0+/wdM7oodNJhhf2o89B6mct9qK2K/fifqNfbliOtufzRXbDIe7C1Tj0DRqMNt1vArdlGzV3+/vmKS6w==}
+  '@pnpm/lockfile.utils@1102.1.2':
+    resolution: {integrity: sha512-PExxSzrpqij5Ylx15M1xc0/6JW8c5hqURMuPhqlAA17NbbiVqLS7CjXki+mncENFbYtMB1MMQFPOp66e0a9nAg==}
     engines: {node: '>=22.13'}
 
   '@pnpm/logger@1100.0.0':
@@ -5660,8 +5662,8 @@ packages:
     resolution: {integrity: sha512-brBPFjkEpeaObtbrKKdvMbBSrPz8M4PDoxnRBGYRsBjIZTarmRZGtsQp7763GvZZTvGKazrg7sm9VCLskXjF7w==}
     engines: {node: '>=22.13'}
 
-  '@pnpm/resolving.tarball-url@1101.1.0':
-    resolution: {integrity: sha512-3xq74ustSkAD2RQIRAZjBde0OokVgq1tuDw0eu0pZkxQnAc9T9YSx3AFHa9+UwtgNsZziKvS1PqZqubzJWGxQQ==}
+  '@pnpm/resolving.tarball-url@1101.1.1':
+    resolution: {integrity: sha512-RUKCe4U/UWekLElEHIR2CXuS03SpJON7V5yNqxObBn3w1NkTxA9nRFqEhLBzDGXS4lXKORzq8zgpYuTrv1ikuw==}
     engines: {node: '>=22.13'}
 
   '@pnpm/store.cafs-types@1100.1.0':
@@ -6276,7 +6278,7 @@ packages:
     resolution: {integrity: sha512-66PGTMIiVJP3t4a5yxU9qPtf7MdTBs8jmToMvy+HVflB3Yy13WJZTtPePdvU+wjRV02SKK5doLbSA6o9pwOmiA==}
     peerDependencies:
       msw: ^2.4.9
-      vite: 8.2.2
+      vite: 8.3.0
     peerDependenciesMeta:
       msw:
         optional: true
@@ -6301,7 +6303,7 @@ packages:
     resolution: {integrity: sha512-VFej4WEPuOsenIfMEROl0CkvPeZNZXYtL+p5XQEukoRCkWhVYZNlEHcNTysyzDpvQz7+gGM6LzJQZ9lkh5yzJw==}
     engines: {node: '>= 18'}
     peerDependencies:
-      vite: 8.2.2
+      vite: 8.3.0
       vitest: '>=3.1.0'
 
   '@vitiate/engine-darwin-arm64@0.3.1':
@@ -6463,8 +6465,8 @@ packages:
     resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
     engines: {node: '>=12'}
 
-  ast-v8-to-istanbul@1.0.5:
-    resolution: {integrity: sha512-UPAgKJFSEGMWSDr3LX4tqnAb4f7KGT8O40Tyx8wbYmmZ/yn58lNCm8h3svs3eXgiGd5AXxz8NDOvXWvicq+rJA==}
+  ast-v8-to-istanbul@1.0.6:
+    resolution: {integrity: sha512-fvpl29helSO2w/z7utIbrkNXILdrLwDwAMH2I/zPKlGf5244+gf+B4cyS1sANcrPY2h+hWCGSgC8N61s/+AF9A==}
 
   asynckit@0.4.0:
     resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==}
@@ -6474,7 +6476,7 @@ packages:
     engines: {node: '>=20.0.0'}
     hasBin: true
     peerDependencies:
-      yaml: 2.9.0
+      yaml: 2.9.1
     peerDependenciesMeta:
       yaml:
         optional: true
@@ -6574,16 +6576,16 @@ packages:
   boolbase@1.0.0:
     resolution: {integrity: sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==}
 
-  brace-expansion@5.0.9:
-    resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==}
+  brace-expansion@5.0.12:
+    resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==}
     engines: {node: 20 || >=22}
 
   braces@3.0.3:
     resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
     engines: {node: '>=8'}
 
-  browserslist@4.28.8:
-    resolution: {integrity: sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==}
+  browserslist@4.28.9:
+    resolution: {integrity: sha512-EWazOblFYUvlGZcfGhPUPmYh3nikUxBVb+y9MJun5f3hBi812X+8MSQTujLBtgK3cf51fJWbWfOjyeO954d+Eg==}
     engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
     hasBin: true
 
@@ -6740,8 +6742,8 @@ packages:
     resolution: {integrity: sha512-dnN3ibLeoRf2HNC+OlCiNc5d2zxbLJXOtiZUudNFSXZrNSydxcCsSpRzXwfu7BBWCIfHPw+xTayeBvJCP/D8Ng==}
     engines: {node: '>= 18'}
 
-  compromise@14.16.0:
-    resolution: {integrity: sha512-4DFYl/Hl7sW4XWUDfx9S5vxqyYKpZDwwqrpXsQv5acdbVP+joKceIcIaLb0lhVWUpDBV0OnExk/o/dnYUwXnhQ==}
+  compromise@14.17.0:
+    resolution: {integrity: sha512-zw9iEcts/8tMDASNopMQEs3Pclkx2Xk7XCltAb/oV1LEZcCQpDaalAtFmvuxYo+wnVDsW3H3oT16mw9qVHpkqA==}
     engines: {node: '>=12.0.0'}
 
   comver-to-semver@2.0.0:
@@ -6914,9 +6916,9 @@ packages:
     resolution: {integrity: sha512-BoK1sWdcOMKq58aGaChMbEMhrOJ+2ZPvlvASFXFkduq++6k/ZYi5c9RXaeLXcuTRZDOj/5lvJR4+j93+BXepSw==}
     engines: {node: '>=22'}
 
-  ecc-agentshield@1.4.0:
-    resolution: {integrity: sha512-R98OO1Ujyk2lezDLb+iQmMhF6FwTJCHajy3G4FCB6x7wkSTqR9f8+eAelC5KDzYDsGSbc0sOZvjXOOPRBtMpDg==}
-    engines: {node: '>=18'}
+  ecc-agentshield@1.6.0:
+    resolution: {integrity: sha512-lpeHG96DtEn7ofq7Iiyvq29piQOwParaiZOdDB206i4ZeCL4yjwT6xN5BSGI4yhCEAN0eO0f9F9hxHLBuRqf/g==}
+    engines: {node: '>=20'}
     hasBin: true
 
   ee-first@1.1.1:
@@ -6926,8 +6928,8 @@ packages:
     resolution: {integrity: sha512-/RInbCy1d4P6Zdfa+TMVsf/ufZVotat5hCw3QXmWtjU+3pFEOvOQ7ibo3aIxyCJw2leIeAMjmPj+1SLJiCpdrQ==}
     engines: {node: '>=12.0.0'}
 
-  electron-to-chromium@1.5.418:
-    resolution: {integrity: sha512-UzS26r3AEbG5wSoGVpJKqwHIU9zwQN7LHdVIThDrJpS0I5KdlXFMEb8543fhc9dVnIIAST6ar8rhwa00AL5MlA==}
+  electron-to-chromium@1.5.428:
+    resolution: {integrity: sha512-1JxbaFJj1bRKurj1uY3l4xxpU9kOUAUjcIgApj0qu1Pao5GhoIWI8iL0BeMYJ2njig1hBx0A7eKD9VGjH9wlHw==}
 
   emoji-regex@10.6.0:
     resolution: {integrity: sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==}
@@ -7031,8 +7033,8 @@ packages:
     resolution: {integrity: sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==}
     engines: {node: '>= 18'}
 
-  fast-check@4.9.0:
-    resolution: {integrity: sha512-7ms6T7SybUev/PQITciI0yLM2pOSFy5zpG8Ty7tQofcVaQUvrMXp6CBwqF6fThLCLOrfBtuHAtwq6Yu4XPCllg==}
+  fast-check@4.10.0:
+    resolution: {integrity: sha512-hhqQL+IJllZi3aM4TKvmCj3bywLEcycNTTLZeLhA9ttMxBrCqM07q7Di4kl+j9EWSTXvJH1+EpIgsDbF/+8H5Q==}
     engines: {node: '>=12.17.0'}
 
   fast-deep-equal@3.1.3:
@@ -7048,8 +7050,8 @@ packages:
   fast-safe-stringify@2.1.1:
     resolution: {integrity: sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==}
 
-  fast-uri@4.1.4:
-    resolution: {integrity: sha512-dODXrIxlS9JSdgAnhIUKOosKV1oMtU2VtVw87QRaHzyl5jxO290Ii5tEZfCfzfWNHi3jKWwBSdQj0qIyshdZdQ==}
+  fast-uri@4.1.5:
+    resolution: {integrity: sha512-vZeoMRB4epNr7QfdHxel7te/RcX16CxyXI07JCCTFWZA2s4v1azGNESRj+2EoaHSaWFL/Z3GmKT2jF6A202jLg==}
 
   fast-xml-builder@1.3.1:
     resolution: {integrity: sha512-pIM/1n3ntFXKYrUZwW7QCK0gAW7XY+wzj1YMIV3tLDvPj/V+zTGJK5e3/4WJfwj0qWw2ElNXiTixda/R+3YSug==}
@@ -7181,8 +7183,8 @@ packages:
     resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
     engines: {node: '>=8'}
 
-  hono@4.13.5:
-    resolution: {integrity: sha512-O6+/eCYRkzzzy0rPWwKLiGBR1nFuUPZynnwjxN1MBA62NNqbT0wQEzQyK2gSO5yDIDB336sXQleAhOHrzlYyKw==}
+  hono@4.13.8:
+    resolution: {integrity: sha512-/Gng7NfoykZl2pjukW5Z6+8Yxm3BPRf86GTbQnt0SbySkvax4fyL4H3HhY1cCpBGmiW9XDRFzRV+CXK2W8QudQ==}
     engines: {node: '>=16.9.0'}
 
   hosted-git-info@4.1.0:
@@ -7237,8 +7239,8 @@ packages:
     resolution: {integrity: sha512-FCeMZT4NiRQGh+YkeKMtWrOmBgWjHjMJ26WQWrRQyoyzqevdaGSakUaJW5xQYmjLlUVk2qUnCjYVBax9EKKg8A==}
     engines: {node: ^20.17.0 || >=22.9.0}
 
-  ignore@7.0.7:
-    resolution: {integrity: sha512-dML0wP6oak21rsNYCJpJB6O1BJIEwNpGrTw0URPfAk4hm0e3pRfCtzkfB6olBcXcVlU2rouCyz7lCyRB0OMVCA==}
+  ignore@7.0.9:
+    resolution: {integrity: sha512-brTTsvFRt5C1gGHtPst/281UjPD5t9fBqbgoMPlVWy11ZLTPfu7HxK4ZYqO9H7o/yC9rSTCI85EaQ4OoY12qYw==}
     engines: {node: '>= 4'}
 
   individual@3.0.0:
@@ -7251,8 +7253,8 @@ packages:
     resolution: {integrity: sha512-IBTdIkzZNOpqm7q3dRqJvMaldXjDHWkEDfrwGEQTs5eaQMWV+djAhR+wahyNNMAa+qpbDUhBMVt4ZKNwpPm7xQ==}
     engines: {node: ^20.17.0 || >=22.9.0}
 
-  ip-address@10.7.0:
-    resolution: {integrity: sha512-BGFsyJd5mpXp3rK6jIdADLNgpJUK1jnjzvYF8lK+VyDab9JAmqN0YOKDdP17HlgKb2+ehPgDc8EtnRLbGCAMhA==}
+  ip-address@10.7.1:
+    resolution: {integrity: sha512-4OUAqU9Z1i3vCnS05hzGiFnEMDpQ+62pAD/MVQOp83fYyNC8GleCqaS0QikQBmcWCrKFiUs/B8ztRRiYOAXuCA==}
     engines: {node: '>= 12'}
 
   ipaddr.js@1.9.1:
@@ -7551,8 +7553,8 @@ packages:
     resolution: {integrity: sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==}
     engines: {node: '>=10'}
 
-  magic-string@1.2.3:
-    resolution: {integrity: sha512-Bpb0W2TbLKOZ7vJnOUnVRGq3WL2p+ISV29M6hYPL1AFCpyKZpdr5ytiXoTSSxRVhg8YW7f65+6gbG8WG6PCa/g==}
+  magic-string@1.4.1:
+    resolution: {integrity: sha512-8lyCu36ErXR0J9uaGKlKQoiLZKmtI63YGLE8G2o9jyRPdr4X47LusSOwgOJOzcVtp81fTAAjxR7BwKz682Jhow==}
 
   magicast@0.5.4:
     resolution: {integrity: sha512-llBEhWm1SacoRwgHUoQJYtwp4PBLF4faQi5TCpIGyGs9n4y5+juI0tDgyKIfpqxckRHaHzouUEph3THklWh03w==}
@@ -7577,8 +7579,8 @@ packages:
     resolution: {integrity: sha512-hdN1wVrZbb29eBGiGjJbeP8JbKjq1urkHJ/LIP/NY48MZ1QVXUsQBV1G1zvYFHn1XE06cwjBsOI2K3Ulnj1YXQ==}
     engines: {node: '>=8'}
 
-  markdown-it@14.3.1:
-    resolution: {integrity: sha512-4Ej49aYTDFIQ+uBkfX8GBvJGccoARxxPep+7aWTs55ozbjQJpW9M26Fe53vnGgvLeVzva/amzjQQaQu9w0vMhA==}
+  markdown-it@14.3.2:
+    resolution: {integrity: sha512-sHHjZ5fJKlgrG4qns2YwVcdNep35h5fERrfkD2YNsb9UFk0UIHarbiTaHKVMlPuWAoiilyK8Fv/jAm11slsY7Q==}
     hasBin: true
 
   markdown-table@3.0.4:
@@ -8082,9 +8084,9 @@ packages:
     resolution: {integrity: sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==}
     engines: {node: '>= 0.8'}
 
-  pastoralist@1.13.0:
-    resolution: {integrity: sha512-ug6sNNqIBBHeRhpDgbYSuWbMrxH1gu+alEj/fkeilEdu893hb/Af+A3XlwgAAOlKxvMLiUyWz7RW1s2yELNFmw==}
-    engines: {node: '>=20'}
+  pastoralist@1.13.2:
+    resolution: {integrity: sha512-3Xdd1GEmCtKv4dMwWUhl2XvJjRII2yLxkSfZoIhVAxNtgLP2u5lAZxXxKejITb4soNV5Z8vVhL0KoeuJGymcpQ==}
+    engines: {node: '>=20.19.0'}
     hasBin: true
 
   path-exists@4.0.0:
@@ -8418,6 +8420,10 @@ packages:
     resolution: {integrity: sha512-aqVvWoyO21L23mb+drl4RmMXbf6N7FdHjAhTRA9ZBL7apWBgfWC16KjrASI+1p9GAroljyMHj6fK67i0UiTNvQ==}
     engines: {node: '>= 18'}
 
+  smol-toml@1.8.0:
+    resolution: {integrity: sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ==}
+    engines: {node: '>= 18'}
+
   socks-proxy-agent@10.1.0:
     resolution: {integrity: sha512-WlMj/67cEJ6MDI1OcsnjuYKDNDoyPCCYZ249kuuXPiMDw9F8PXkVaQ7YWu3siTydfQ/4BEZcvGzu+aYvz7dDCQ==}
     engines: {node: '>= 20'}
@@ -8522,8 +8528,8 @@ packages:
   strnum@2.4.2:
     resolution: {integrity: sha512-rDG3Ah4TV0k1hWvLSzkZtMmLN9+eS+h3knq4MP6A42Y3Yh5qGNnOUs1jJkoSr8FG5dsL28c7KgkIBzSEykqtuw==}
 
-  suffix-thumb@5.0.2:
-    resolution: {integrity: sha512-I5PWXAFKx3FYnI9a+dQMWNqTxoRt6vdBdb0O+BJ1sxXCWtSoQCusc13E58f+9p4MYx/qCnEMkD5jac6K2j3dgA==}
+  suffix-thumb@5.0.3:
+    resolution: {integrity: sha512-d77avV91FwJkDA0juRQ19XjE1lE1cNCVIWS0ZRicXqdMN28yjO5LltzEkZBNAWS7qHpn37c1fU4PkIJ/rjJQEA==}
 
   supports-color@5.5.0:
     resolution: {integrity: sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==}
@@ -8673,8 +8679,8 @@ packages:
     resolution: {integrity: sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==}
     engines: {node: '>= 18'}
 
-  typebox@1.3.30:
-    resolution: {integrity: sha512-vRmBLzlaq9O9dvfGmI5CssLGvDC/R594kH6N/Q1uUU5VPO3PTgQMlWe/UVNdNVTr2EET+FX8BWZkFdYgxTglbQ==}
+  typebox@1.3.31:
+    resolution: {integrity: sha512-7++UxOb7lAJbJ8pbhN2Yl/ljadShbHZ6GQwst/YEUAlVh1nP8LqYpC2t+R1VysunFpmDffDzhZRsvGchx0PqUA==}
 
   typescript@5.9.3:
     resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
@@ -8704,8 +8710,8 @@ packages:
   undici-types@8.9.0:
     resolution: {integrity: sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==}
 
-  undici@6.28.0:
-    resolution: {integrity: sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==}
+  undici@6.28.1:
+    resolution: {integrity: sha512-zWpdTVD54H48CIybL0rWQ3ukpb9d23wM7eH5RtfdmeP70cWHNjtfo7P4vZX+5CoDcO53J4Pu5uXp7lNfjc6DRA==}
     engines: {node: '>=18.17'}
 
   unicorn-magic@0.3.0:
@@ -8782,13 +8788,13 @@ packages:
     resolution: {integrity: sha512-zj/ob3UsvJGN0whEAKFp53REA5X66hvffVqoCtVQAakJKnKlH+/PcOfMoFwIG/o4rElqLv/ycAFlx8ZlXUorCg==}
     engines: {node: '>=18.12.0'}
 
-  vite@8.2.2:
-    resolution: {integrity: sha512-cFKLV/PRgAUlIRm5WjMjJ86jrftzpqcgH+Us+DS8mI3CDNiH30Whrz8uHL3+MOLPAgqbMBAqWdAHAphOAM+z/Q==}
+  vite@8.3.0:
+    resolution: {integrity: sha512-lhZBVvEHefgE+HQZC9O7EBJgCU/nVzFNl7vkS4RE0APtWLP02/8QVIkQtzBxPquh7lq5/78NHipTj7ODQ6XuyQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
       '@types/node': ^20.19.0 || >=22.12.0
-      '@vitejs/devtools': ^0.4.0 || ^0.5.0
+      '@vitejs/devtools': ^0.7.1
       esbuild: ^0.27.0 || ^0.28.0
       jiti: '>=1.21.0'
       less: ^4.0.0
@@ -8798,7 +8804,7 @@ packages:
       sugarss: ^5.0.0
       terser: ^5.16.0
       tsx: ^4.8.1
-      yaml: 2.9.0
+      yaml: 2.9.1
     peerDependenciesMeta:
       '@types/node':
         optional: true
@@ -8841,7 +8847,7 @@ packages:
       '@vitest/ui': 5.0.0
       happy-dom: '*'
       jsdom: '*'
-      vite: 8.2.2
+      vite: 8.3.0
     peerDependenciesMeta:
       '@edge-runtime/vm':
         optional: true
@@ -8951,8 +8957,8 @@ packages:
     resolution: {integrity: sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==}
     engines: {node: '>=18'}
 
-  yaml@2.9.0:
-    resolution: {integrity: sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==}
+  yaml@2.9.1:
+    resolution: {integrity: sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==}
     engines: {node: '>= 14.6'}
     hasBin: true
 
@@ -8991,8 +8997,8 @@ packages:
   zod@4.1.13:
     resolution: {integrity: sha512-AvvthqfqrAhNH9dnfmrfKzX5upOdjUVJYFqNSlkmGf64gRaTzlPwz99IHYnVs28qYAybvAlBV+H7pn0saFY4Ig==}
 
-  zod@4.5.4:
-    resolution: {integrity: sha512-sC95tT5iHHH9gtpj6A81kh+NEaRAUFN+qlUPDUbRfOMvNf5QCBqsb3WgvnpVtK5Y+4UfA6KqufotuTvMGiTlsA==}
+  zod@4.6.5:
+    resolution: {integrity: sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==}
 
   zwitch@2.0.4:
     resolution: {integrity: sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==}
@@ -9008,7 +9014,7 @@ snapshots:
     dependencies:
       '@actions/expressions': 0.3.60
       cronstrue: 2.59.0
-      yaml: 2.9.0
+      yaml: 2.9.1
 
   '@antfu/ni@30.5.0':
     dependencies:
@@ -9017,40 +9023,40 @@ snapshots:
       tinyexec: 1.3.1
       tinyglobby: 0.2.17
 
-  '@anthropic-ai/claude-code-darwin-arm64@2.1.251':
+  '@anthropic-ai/claude-code-darwin-arm64@2.1.272':
     optional: true
 
-  '@anthropic-ai/claude-code-darwin-x64@2.1.251':
+  '@anthropic-ai/claude-code-darwin-x64@2.1.272':
     optional: true
 
-  '@anthropic-ai/claude-code-linux-arm64-musl@2.1.251':
+  '@anthropic-ai/claude-code-linux-arm64-musl@2.1.272':
     optional: true
 
-  '@anthropic-ai/claude-code-linux-arm64@2.1.251':
+  '@anthropic-ai/claude-code-linux-arm64@2.1.272':
     optional: true
 
-  '@anthropic-ai/claude-code-linux-x64-musl@2.1.251':
+  '@anthropic-ai/claude-code-linux-x64-musl@2.1.272':
     optional: true
 
-  '@anthropic-ai/claude-code-linux-x64@2.1.251':
+  '@anthropic-ai/claude-code-linux-x64@2.1.272':
     optional: true
 
-  '@anthropic-ai/claude-code-win32-arm64@2.1.251':
+  '@anthropic-ai/claude-code-win32-arm64@2.1.272':
     optional: true
 
-  '@anthropic-ai/claude-code-win32-x64@2.1.251':
+  '@anthropic-ai/claude-code-win32-x64@2.1.272':
     optional: true
 
-  '@anthropic-ai/claude-code@2.1.251':
+  '@anthropic-ai/claude-code@2.1.272':
     optionalDependencies:
-      '@anthropic-ai/claude-code-darwin-arm64': 2.1.251
-      '@anthropic-ai/claude-code-darwin-x64': 2.1.251
-      '@anthropic-ai/claude-code-linux-arm64': 2.1.251
-      '@anthropic-ai/claude-code-linux-arm64-musl': 2.1.251
-      '@anthropic-ai/claude-code-linux-x64': 2.1.251
-      '@anthropic-ai/claude-code-linux-x64-musl': 2.1.251
-      '@anthropic-ai/claude-code-win32-arm64': 2.1.251
-      '@anthropic-ai/claude-code-win32-x64': 2.1.251
+      '@anthropic-ai/claude-code-darwin-arm64': 2.1.272
+      '@anthropic-ai/claude-code-darwin-x64': 2.1.272
+      '@anthropic-ai/claude-code-linux-arm64': 2.1.272
+      '@anthropic-ai/claude-code-linux-arm64-musl': 2.1.272
+      '@anthropic-ai/claude-code-linux-x64': 2.1.272
+      '@anthropic-ai/claude-code-linux-x64-musl': 2.1.272
+      '@anthropic-ai/claude-code-win32-arm64': 2.1.272
+      '@anthropic-ai/claude-code-win32-x64': 2.1.272
 
   '@anthropic-ai/sdk@0.39.0':
     dependencies:
@@ -9131,7 +9137,7 @@ snapshots:
     dependencies:
       '@babel/compat-data': 7.29.7
       '@babel/helper-validator-option': 7.29.7
-      browserslist: 4.28.8
+      browserslist: 4.28.9
       lru-cache: 5.1.1
       semver: 7.8.5
 
@@ -9467,9 +9473,9 @@ snapshots:
 
   '@henrygd/queue@1.2.0': {}
 
-  '@hono/node-server@1.19.14(hono@4.13.5)':
+  '@hono/node-server@1.19.14(hono@4.13.8)':
     dependencies:
-      hono: 4.13.5
+      hono: 4.13.8
 
   '@iarna/toml@2.2.5': {}
 
@@ -9495,6 +9501,8 @@ snapshots:
 
   '@jridgewell/sourcemap-codec@1.5.5': {}
 
+  '@jridgewell/sourcemap-codec@1.6.0': {}
+
   '@jridgewell/trace-mapping@0.3.31':
     dependencies:
       '@jridgewell/resolve-uri': 3.1.2
@@ -9502,7 +9510,7 @@ snapshots:
 
   '@js-sdsl/ordered-map@4.4.2': {}
 
-  '@mdn/browser-compat-data@8.1.0': {}
+  '@mdn/browser-compat-data@8.1.1': {}
 
   '@modelcontextprotocol/client@2.0.0':
     dependencies:
@@ -9512,22 +9520,22 @@ snapshots:
       eventsource-parser: 3.1.0
       jose: 6.2.3
       pkce-challenge: 5.0.1
-      zod: 4.5.4
+      zod: 4.6.5
 
   '@modelcontextprotocol/core@2.0.0':
     dependencies:
-      zod: 4.5.4
+      zod: 4.6.5
 
-  '@modelcontextprotocol/node@2.0.0(@modelcontextprotocol/server@2.0.0)(hono@4.13.5)':
+  '@modelcontextprotocol/node@2.0.0(@modelcontextprotocol/server@2.0.0)(hono@4.13.8)':
     dependencies:
-      '@hono/node-server': 1.19.14(hono@4.13.5)
+      '@hono/node-server': 1.19.14(hono@4.13.8)
       '@modelcontextprotocol/server': 2.0.0
     optionalDependencies:
-      hono: 4.13.5
+      hono: 4.13.8
 
-  '@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.5.4)':
+  '@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.6.5)':
     dependencies:
-      '@hono/node-server': 1.19.14(hono@4.13.5)
+      '@hono/node-server': 1.19.14(hono@4.13.8)
       ajv: 8.20.0
       ajv-formats: 3.0.1(ajv@8.20.0)
       content-type: 2.1.0
@@ -9537,13 +9545,13 @@ snapshots:
       eventsource-parser: 3.1.0
       express: 5.2.1(supports-color@7.2.0)
       express-rate-limit: 8.7.0(express@5.2.1(supports-color@7.2.0))(supports-color@7.2.0)
-      hono: 4.13.5
+      hono: 4.13.8
       jose: 6.2.3
       json-schema-typed: 8.0.2
       pkce-challenge: 5.0.1
       raw-body: 3.0.2
-      zod: 4.5.4
-      zod-to-json-schema: 3.25.2(zod@4.5.4)
+      zod: 4.6.5
+      zod-to-json-schema: 3.25.2(zod@4.6.5)
     transitivePeerDependencies:
       - supports-color
     optional: true
@@ -9551,7 +9559,7 @@ snapshots:
   '@modelcontextprotocol/server@2.0.0':
     dependencies:
       '@modelcontextprotocol/core': 2.0.0
-      zod: 4.5.4
+      zod: 4.6.5
 
   '@mswjs/interceptors@0.41.9':
     dependencies:
@@ -9970,14 +9978,14 @@ snapshots:
       '@pnpm/graceful-fs': 1000.1.0
       ssri: 10.0.5
 
-  '@pnpm/crypto.hash@1100.0.3':
+  '@pnpm/crypto.hash@1100.0.4':
     dependencies:
-      '@pnpm/fs.graceful-fs': 1100.2.0
+      '@pnpm/fs.graceful-fs': 1100.2.1
       ssri: 13.0.1
 
-  '@pnpm/crypto.integrity@1100.0.5':
+  '@pnpm/crypto.integrity@1100.0.6':
     dependencies:
-      '@pnpm/error': 1100.1.3
+      '@pnpm/error': 1100.1.4
 
   '@pnpm/crypto.polyfill@1000.1.0': {}
 
@@ -9987,13 +9995,13 @@ snapshots:
       '@pnpm/types': 1001.3.0
       semver: 7.8.5
 
-  '@pnpm/deps.path@1101.0.1':
+  '@pnpm/deps.path@1101.0.2':
     dependencies:
-      '@pnpm/crypto.hash': 1100.0.3
+      '@pnpm/crypto.hash': 1100.0.4
       '@pnpm/types': 1102.1.0
       semver: 7.8.5
 
-  '@pnpm/error@1100.1.3':
+  '@pnpm/error@1100.1.4':
     dependencies:
       '@pnpm/constants': 1102.0.0
 
@@ -10003,7 +10011,7 @@ snapshots:
       '@pnpm/types': 1102.1.0
       '@types/ssri': 7.1.5
 
-  '@pnpm/fs.graceful-fs@1100.2.0':
+  '@pnpm/fs.graceful-fs@1100.2.1':
     dependencies:
       graceful-fs: 4.2.11
 
@@ -10011,28 +10019,28 @@ snapshots:
     dependencies:
       graceful-fs: 4.2.11
 
-  '@pnpm/hooks.types@1101.0.1':
+  '@pnpm/hooks.types@1101.0.2':
     dependencies:
       '@pnpm/fetching.fetcher-base': 1100.2.9
-      '@pnpm/lockfile.types': 1100.1.0
+      '@pnpm/lockfile.types': 1100.1.1
       '@pnpm/resolving.resolver-base': 1101.2.0
       '@pnpm/store.cafs-types': 1100.1.0
       '@pnpm/types': 1102.1.0
 
-  '@pnpm/lockfile.detect-dep-types@1100.0.21':
+  '@pnpm/lockfile.detect-dep-types@1100.0.23':
     dependencies:
-      '@pnpm/deps.path': 1101.0.1
-      '@pnpm/lockfile.types': 1100.1.0
+      '@pnpm/deps.path': 1101.0.2
+      '@pnpm/lockfile.types': 1100.1.1
       '@pnpm/types': 1102.1.0
 
-  '@pnpm/lockfile.fs@1100.2.5(@pnpm/logger@1100.0.0)':
+  '@pnpm/lockfile.fs@1100.2.7(@pnpm/logger@1100.0.0)':
     dependencies:
       '@pnpm/constants': 1102.0.0
-      '@pnpm/deps.path': 1101.0.1
-      '@pnpm/error': 1100.1.3
-      '@pnpm/lockfile.merger': 1100.0.21
-      '@pnpm/lockfile.types': 1100.1.0
-      '@pnpm/lockfile.utils': 1102.1.0
+      '@pnpm/deps.path': 1101.0.2
+      '@pnpm/error': 1100.1.4
+      '@pnpm/lockfile.merger': 1100.0.22
+      '@pnpm/lockfile.types': 1100.1.1
+      '@pnpm/lockfile.utils': 1102.1.2
       '@pnpm/logger': 1100.0.0
       '@pnpm/network.git-utils': 1100.0.3
       '@pnpm/object.key-sorting': 1100.0.2
@@ -10046,30 +10054,30 @@ snapshots:
       strip-bom: 5.0.0
       write-file-atomic: 7.0.1
 
-  '@pnpm/lockfile.merger@1100.0.21':
+  '@pnpm/lockfile.merger@1100.0.22':
     dependencies:
-      '@pnpm/lockfile.types': 1100.1.0
+      '@pnpm/lockfile.types': 1100.1.1
       '@pnpm/types': 1102.1.0
       comver-to-semver: 2.0.0
       ramda: '@pnpm/ramda@0.28.1'
       semver: 7.8.5
 
-  '@pnpm/lockfile.types@1100.1.0':
+  '@pnpm/lockfile.types@1100.1.1':
     dependencies:
       '@pnpm/patching.types': 1100.0.1
       '@pnpm/resolving.resolver-base': 1101.2.0
       '@pnpm/types': 1102.1.0
 
-  '@pnpm/lockfile.utils@1102.1.0':
+  '@pnpm/lockfile.utils@1102.1.2':
     dependencies:
       '@pnpm/config.normalize-registries': 1101.0.1
       '@pnpm/constants': 1102.0.0
-      '@pnpm/deps.path': 1101.0.1
-      '@pnpm/error': 1100.1.3
-      '@pnpm/hooks.types': 1101.0.1
-      '@pnpm/lockfile.types': 1100.1.0
+      '@pnpm/deps.path': 1101.0.2
+      '@pnpm/error': 1100.1.4
+      '@pnpm/hooks.types': 1101.0.2
+      '@pnpm/lockfile.types': 1100.1.1
       '@pnpm/resolving.resolver-base': 1101.2.0
-      '@pnpm/resolving.tarball-url': 1101.1.0
+      '@pnpm/resolving.tarball-url': 1101.1.1
       '@pnpm/types': 1102.1.0
       ramda: '@pnpm/ramda@0.28.1'
 
@@ -10095,9 +10103,9 @@ snapshots:
     dependencies:
       '@pnpm/types': 1102.1.0
 
-  '@pnpm/resolving.tarball-url@1101.1.0':
+  '@pnpm/resolving.tarball-url@1101.1.1':
     dependencies:
-      '@pnpm/crypto.integrity': 1100.0.5
+      '@pnpm/crypto.integrity': 1100.0.6
       '@pnpm/types': 1102.1.0
 
   '@pnpm/store.cafs-types@1100.1.0': {}
@@ -10534,12 +10542,12 @@ snapshots:
       '@bcoe/v8-coverage': 1.0.2
       '@vitest/istanbul-lib-coverage': 1.0.1
       '@vitest/istanbul-lib-report': 1.0.1
-      ast-v8-to-istanbul: 1.0.5
+      ast-v8-to-istanbul: 1.0.6
       magicast: 0.5.4
       obug: 2.1.4
       std-env: 4.2.0
       tinyrainbow: 3.1.1
-      vitest: 5.0.0(patch_hash=555bbde80f3e83833e33f6825435e36659d4e2a927e2a3cb5dbc4d6eaeef976b)(@types/node@26.5.1)(@vitest/coverage-v8@5.0.0)(@vitest/ui@5.0.0)(vite@8.2.2(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+      vitest: 5.0.0(patch_hash=555bbde80f3e83833e33f6825435e36659d4e2a927e2a3cb5dbc4d6eaeef976b)(@types/node@26.5.1)(@vitest/coverage-v8@5.0.0)(@vitest/ui@5.0.0)(vite@8.3.0(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.1))
 
   '@vitest/istanbul-lib-coverage@1.0.1': {}
 
@@ -10547,14 +10555,14 @@ snapshots:
     dependencies:
       '@vitest/istanbul-lib-coverage': 1.0.1
 
-  '@vitest/mocker@5.0.0(vite@8.2.2(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))':
+  '@vitest/mocker@5.0.0(vite@8.3.0(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.1))':
     dependencies:
       '@jridgewell/trace-mapping': 0.3.31
       '@vitest/spy': 5.0.0
       estree-walker: 3.0.3
-      magic-string: 1.2.3
+      magic-string: 1.4.1
     optionalDependencies:
-      vite: 8.2.2(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)
+      vite: 8.3.0(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.1)
 
   '@vitest/pretty-format@5.0.0':
     dependencies:
@@ -10570,7 +10578,7 @@ snapshots:
       pathe: 2.0.3
       sirv: 3.0.2
       tinyrainbow: 3.1.1
-      vitest: 5.0.0(patch_hash=555bbde80f3e83833e33f6825435e36659d4e2a927e2a3cb5dbc4d6eaeef976b)(@types/node@26.5.1)(@vitest/coverage-v8@5.0.0)(@vitest/ui@5.0.0)(vite@8.2.2(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+      vitest: 5.0.0(patch_hash=555bbde80f3e83833e33f6825435e36659d4e2a927e2a3cb5dbc4d6eaeef976b)(@types/node@26.5.1)(@vitest/coverage-v8@5.0.0)(@vitest/ui@5.0.0)(vite@8.3.0(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.1))
 
   '@vitest/utils@5.0.0':
     dependencies:
@@ -10578,7 +10586,7 @@ snapshots:
       convert-source-map: 2.0.0
       tinyrainbow: 3.1.1
 
-  '@vitiate/core@0.3.1(typescript@7.1.0-dev.20260904.1)(vite@8.2.2(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))(vitest@5.0.0)':
+  '@vitiate/core@0.3.1(typescript@7.1.0-dev.20260904.1)(vite@8.3.0(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.1))(vitest@5.0.0)':
     dependencies:
       '@optique/core': 1.1.0
       '@optique/run': 1.1.0
@@ -10588,10 +10596,10 @@ snapshots:
       es-module-lexer: 2.3.2
       escape-string-regexp: 5.0.0
       ipaddr.js: 2.4.0
-      magic-string: 1.2.3
+      magic-string: 1.4.1
       valibot: 1.4.2(typescript@7.1.0-dev.20260904.1)
-      vite: 8.2.2(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)
-      vitest: 5.0.0(patch_hash=555bbde80f3e83833e33f6825435e36659d4e2a927e2a3cb5dbc4d6eaeef976b)(@types/node@26.5.1)(@vitest/coverage-v8@5.0.0)(@vitest/ui@5.0.0)(vite@8.2.2(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+      vite: 8.3.0(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.1)
+      vitest: 5.0.0(patch_hash=555bbde80f3e83833e33f6825435e36659d4e2a927e2a3cb5dbc4d6eaeef976b)(@types/node@26.5.1)(@vitest/coverage-v8@5.0.0)(@vitest/ui@5.0.0)(vite@8.3.0(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.1))
     transitivePeerDependencies:
       - '@swc/helpers'
       - typescript
@@ -10678,7 +10686,7 @@ snapshots:
   ajv@8.20.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 4.1.4
+      fast-uri: 4.1.5
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
     optional: true
@@ -10715,7 +10723,7 @@ snapshots:
 
   assertion-error@2.0.1: {}
 
-  ast-v8-to-istanbul@1.0.5:
+  ast-v8-to-istanbul@1.0.6:
     dependencies:
       '@jridgewell/trace-mapping': 0.3.31
       estree-walker: 3.0.3
@@ -10723,7 +10731,7 @@ snapshots:
 
   asynckit@0.4.0: {}
 
-  ata-validator@1.27.0(yaml@2.9.0):
+  ata-validator@1.27.0(yaml@2.9.1):
     optionalDependencies:
       '@ata-validator/native-darwin-arm64': 1.27.0
       '@ata-validator/native-darwin-x64': 1.27.0
@@ -10732,7 +10740,7 @@ snapshots:
       '@ata-validator/native-linux-x64-gnu': 1.27.0
       '@ata-validator/native-linux-x64-musl': 1.27.0
       '@ata-validator/native-win32-x64': 1.27.0
-      yaml: 2.9.0
+      yaml: 2.9.1
 
   b4a@1.8.1: {}
 
@@ -10836,7 +10844,7 @@ snapshots:
 
   boolbase@1.0.0: {}
 
-  brace-expansion@5.0.9(patch_hash=a89e05a7c781115d8e78a92c9f9b843aa7c534a587baa5ac808074d4fafa6857):
+  brace-expansion@5.0.12:
     dependencies:
       balanced-match: 4.0.4
 
@@ -10844,13 +10852,13 @@ snapshots:
     dependencies:
       fill-range: 7.1.1
 
-  browserslist@4.28.8:
+  browserslist@4.28.9:
     dependencies:
       baseline-browser-mapping: 2.11.20
       caniuse-lite: 1.0.30001810
-      electron-to-chromium: 1.5.418
+      electron-to-chromium: 1.5.428
       node-releases: 2.0.54
-      update-browserslist-db: 1.3.2(browserslist@4.28.8)
+      update-browserslist-db: 1.3.2(browserslist@4.28.9)
 
   buffer@5.7.1:
     dependencies:
@@ -10998,11 +11006,11 @@ snapshots:
 
   common-ancestor-path@2.0.0: {}
 
-  compromise@14.16.0:
+  compromise@14.17.0:
     dependencies:
       efrt: 2.7.0
       grad-school: 0.0.5
-      suffix-thumb: 5.0.2
+      suffix-thumb: 5.0.3
 
   comver-to-semver@2.0.0: {}
 
@@ -11023,7 +11031,7 @@ snapshots:
 
   core-js-compat@3.49.0:
     dependencies:
-      browserslist: 4.28.8
+      browserslist: 4.28.9
 
   cors@2.8.6:
     dependencies:
@@ -11182,13 +11190,14 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  ecc-agentshield@1.4.0:
+  ecc-agentshield@1.6.0:
     dependencies:
       '@anthropic-ai/sdk': 0.39.0
       chalk: 5.6.2
       commander: 11.1.0
       glob: 13.0.6
-      yaml: 2.9.0
+      smol-toml: 1.8.0
+      yaml: 2.9.1
       zod: 3.25.76
     transitivePeerDependencies:
       - encoding
@@ -11197,7 +11206,7 @@ snapshots:
 
   efrt@2.7.0: {}
 
-  electron-to-chromium@1.5.418: {}
+  electron-to-chromium@1.5.428: {}
 
   emoji-regex@10.6.0: {}
 
@@ -11309,7 +11318,7 @@ snapshots:
     dependencies:
       debug: 4.4.3(supports-color@7.2.0)
       express: 5.2.1(supports-color@7.2.0)
-      ip-address: 10.7.0
+      ip-address: 10.7.1
     transitivePeerDependencies:
       - supports-color
     optional: true
@@ -11348,7 +11357,7 @@ snapshots:
       - supports-color
     optional: true
 
-  fast-check@4.9.0:
+  fast-check@4.10.0:
     dependencies:
       pure-rand: 8.4.2
 
@@ -11367,7 +11376,7 @@ snapshots:
 
   fast-safe-stringify@2.1.1: {}
 
-  fast-uri@4.1.4:
+  fast-uri@4.1.5:
     optional: true
 
   fast-xml-builder@1.3.1:
@@ -11483,7 +11492,7 @@ snapshots:
     dependencies:
       '@sindresorhus/merge-streams': 2.3.0
       fast-glob: 3.3.3
-      ignore: 7.0.7
+      ignore: 7.0.9
       path-type: 6.0.0
       slash: 5.1.0
       unicorn-magic: 0.3.0
@@ -11492,7 +11501,7 @@ snapshots:
     dependencies:
       '@sindresorhus/merge-streams': 4.0.0
       fast-glob: 3.3.3
-      ignore: 7.0.7
+      ignore: 7.0.9
       is-path-inside: 4.0.0
       slash: 5.1.0
       unicorn-magic: 0.4.0
@@ -11507,7 +11516,7 @@ snapshots:
 
   has-flag@4.0.0: {}
 
-  hono@4.13.5: {}
+  hono@4.13.8: {}
 
   hosted-git-info@4.1.0:
     dependencies:
@@ -11570,7 +11579,7 @@ snapshots:
     dependencies:
       minimatch: 10.2.6(patch_hash=83f1ea5b333d1b6fe1b36f93ccb222aa02e5dd468b2c646e285d7d53d234e174)
 
-  ignore@7.0.7: {}
+  ignore@7.0.9: {}
 
   individual@3.0.0: {}
 
@@ -11578,7 +11587,7 @@ snapshots:
 
   ini@6.0.0: {}
 
-  ip-address@10.7.0: {}
+  ip-address@10.7.1: {}
 
   ipaddr.js@1.9.1:
     optional: true
@@ -11766,7 +11775,7 @@ snapshots:
       picomatch: 4.0.7
       string-argv: 0.3.2
       tinyexec: 1.3.1
-      yaml: 2.9.0
+      yaml: 2.9.1
 
   listr2@9.0.5:
     dependencies:
@@ -11807,9 +11816,9 @@ snapshots:
     dependencies:
       yallist: 4.0.0
 
-  magic-string@1.2.3:
+  magic-string@1.4.1:
     dependencies:
-      '@jridgewell/sourcemap-codec': 1.5.5
+      '@jridgewell/sourcemap-codec': 1.6.0
 
   magicast@0.5.4:
     dependencies:
@@ -11860,7 +11869,7 @@ snapshots:
 
   map-obj@4.3.0: {}
 
-  markdown-it@14.3.1:
+  markdown-it@14.3.2:
     dependencies:
       argparse: 2.0.1
       entities: 4.5.0
@@ -11881,7 +11890,7 @@ snapshots:
       js-yaml: 5.2.2
       jsonc-parser: 3.3.1
       jsonpointer: 5.0.1
-      markdown-it: 14.3.1
+      markdown-it: 14.3.2
       markdownlint: 0.41.1(supports-color@7.2.0)
       markdownlint-cli2-formatter-default: 0.0.6(markdownlint-cli2@0.23.2(supports-color@7.2.0))
       micromatch: 4.0.8
@@ -11907,10 +11916,10 @@ snapshots:
     dependencies:
       '@arr/every': 1.0.1
 
-  mcp-tada@0.4.0(@modelcontextprotocol/client@2.0.0)(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.5.4))(typescript@7.1.0-dev.20260904.1):
+  mcp-tada@0.4.0(@modelcontextprotocol/client@2.0.0)(@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.6.5))(typescript@7.1.0-dev.20260904.1):
     optionalDependencies:
       '@modelcontextprotocol/client': 2.0.0
-      '@modelcontextprotocol/sdk': 1.30.0(supports-color@7.2.0)(zod@4.5.4)
+      '@modelcontextprotocol/sdk': 1.30.0(supports-color@7.2.0)(zod@4.6.5)
       typescript: 7.1.0-dev.20260904.1
 
   mdast-util-find-and-replace@3.0.2:
@@ -12273,7 +12282,7 @@ snapshots:
 
   minimatch@10.2.6(patch_hash=83f1ea5b333d1b6fe1b36f93ccb222aa02e5dd468b2c646e285d7d53d234e174):
     dependencies:
-      brace-expansion: 5.0.9(patch_hash=a89e05a7c781115d8e78a92c9f9b843aa7c534a587baa5ac808074d4fafa6857)
+      brace-expansion: 5.0.12
 
   minimist-options@4.1.0:
     dependencies:
@@ -12387,7 +12396,7 @@ snapshots:
       semver: 7.8.5
       tar: 7.5.22
       tinyglobby: 0.2.17
-      undici: 6.28.0
+      undici: 6.28.1
       which: 7.0.0
 
   node-releases@2.0.54: {}
@@ -12619,7 +12628,7 @@ snapshots:
   parseurl@1.3.3:
     optional: true
 
-  pastoralist@1.13.0: {}
+  pastoralist@1.13.2: {}
 
   path-exists@4.0.0: {}
 
@@ -12675,7 +12684,7 @@ snapshots:
 
   pnpm-workspace-yaml@1.8.0:
     dependencies:
-      yaml: 2.9.0
+      yaml: 2.9.1
 
   polka@0.5.2:
     dependencies:
@@ -12866,7 +12875,7 @@ snapshots:
       dockerode: 5.0.1(supports-color@7.2.0)
       dtu-github-actions: 0.18.1(supports-color@7.2.0)
       minimatch: 10.2.6(patch_hash=83f1ea5b333d1b6fe1b36f93ccb222aa02e5dd468b2c646e285d7d53d234e174)
-      yaml: 2.9.0
+      yaml: 2.9.1
     transitivePeerDependencies:
       - supports-color
 
@@ -12953,6 +12962,8 @@ snapshots:
 
   smol-toml@1.7.0: {}
 
+  smol-toml@1.8.0: {}
+
   socks-proxy-agent@10.1.0(supports-color@7.2.0):
     dependencies:
       agent-base: 9.0.0
@@ -12971,7 +12982,7 @@ snapshots:
 
   socks@2.8.9:
     dependencies:
-      ip-address: 10.7.0
+      ip-address: 10.7.1
       smart-buffer: 4.2.0
 
   sort-keys@6.0.1:
@@ -13063,7 +13074,7 @@ snapshots:
     dependencies:
       anynum: 1.0.1
 
-  suffix-thumb@5.0.2: {}
+  suffix-thumb@5.0.3: {}
 
   supports-color@5.5.0:
     dependencies:
@@ -13139,7 +13150,7 @@ snapshots:
       tinyglobby: 0.2.17
       unconfig: 7.5.0
       verkit: 0.3.2
-      yaml: 2.9.0
+      yaml: 2.9.1
 
   teex@1.0.1:
     dependencies:
@@ -13259,7 +13270,7 @@ snapshots:
       media-typer: 1.1.0
       mime-types: 3.0.2
 
-  typebox@1.3.30: {}
+  typebox@1.3.31: {}
 
   typescript@5.9.3: {}
 
@@ -13294,7 +13305,7 @@ snapshots:
 
   undici-types@8.9.0: {}
 
-  undici@6.28.0: {}
+  undici@6.28.1: {}
 
   unicorn-magic@0.3.0: {}
 
@@ -13326,7 +13337,7 @@ snapshots:
   unplugin-purge-polyfills@0.1.0:
     dependencies:
       defu: 6.1.7
-      magic-string: 1.2.3
+      magic-string: 1.4.1
       mlly: 1.8.2
       unplugin: 2.3.11
 
@@ -13337,9 +13348,9 @@ snapshots:
       picomatch: 4.0.7
       webpack-virtual-modules: 0.6.2
 
-  update-browserslist-db@1.3.2(browserslist@4.28.8):
+  update-browserslist-db@1.3.2(browserslist@4.28.9):
     dependencies:
-      browserslist: 4.28.8
+      browserslist: 4.28.9
       escalade: 3.2.0
       picocolors: 1.1.1
 
@@ -13371,7 +13382,7 @@ snapshots:
 
   verkit@0.3.2: {}
 
-  vite@8.2.2(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0):
+  vite@8.3.0(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.1):
     dependencies:
       lightningcss: 1.33.0
       picomatch: 4.0.7
@@ -13383,23 +13394,23 @@ snapshots:
       esbuild: 0.28.1
       fsevents: 2.3.3
       jiti: 2.7.0
-      yaml: 2.9.0
+      yaml: 2.9.1
 
-  vitest@5.0.0(patch_hash=555bbde80f3e83833e33f6825435e36659d4e2a927e2a3cb5dbc4d6eaeef976b)(@types/node@26.5.1)(@vitest/coverage-v8@5.0.0)(@vitest/ui@5.0.0)(vite@8.2.2(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)):
+  vitest@5.0.0(patch_hash=555bbde80f3e83833e33f6825435e36659d4e2a927e2a3cb5dbc4d6eaeef976b)(@types/node@26.5.1)(@vitest/coverage-v8@5.0.0)(@vitest/ui@5.0.0)(vite@8.3.0(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.1)):
     dependencies:
       '@types/chai': 5.2.3
-      '@vitest/mocker': 5.0.0(vite@8.2.2(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))
+      '@vitest/mocker': 5.0.0(vite@8.3.0(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.1))
       chai: 6.2.2
       es-module-lexer: 2.3.2
       expect-type: 1.4.0
-      magic-string: 1.2.3
+      magic-string: 1.4.1
       obug: 2.1.4
       picomatch: 4.0.7
       std-env: 4.2.0
       tinybench: 6.1.4
       tinyexec: 1.3.1
       tinyglobby: 0.2.17
-      vite: 8.2.2(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0)
+      vite: 8.3.0(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.1)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@types/node': 26.5.1
@@ -13408,9 +13419,9 @@ snapshots:
     transitivePeerDependencies:
       - msw
 
-  vitiate@0.3.1(typescript@7.1.0-dev.20260904.1)(vite@8.2.2(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))(vitest@5.0.0):
+  vitiate@0.3.1(typescript@7.1.0-dev.20260904.1)(vite@8.3.0(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.1))(vitest@5.0.0):
     dependencies:
-      '@vitiate/core': 0.3.1(typescript@7.1.0-dev.20260904.1)(vite@8.2.2(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.0))(vitest@5.0.0)
+      '@vitiate/core': 0.3.1(typescript@7.1.0-dev.20260904.1)(vite@8.3.0(@types/node@26.5.1)(esbuild@0.28.1)(jiti@2.7.0)(yaml@2.9.1))(vitest@5.0.0)
     transitivePeerDependencies:
       - '@swc/helpers'
       - typescript
@@ -13483,7 +13494,7 @@ snapshots:
 
   yallist@5.0.0: {}
 
-  yaml@2.9.0: {}
+  yaml@2.9.1: {}
 
   yargs-parser@21.1.1: {}
 
@@ -13512,15 +13523,15 @@ snapshots:
 
   yoctocolors@2.1.2: {}
 
-  zod-to-json-schema@3.25.2(zod@4.5.4):
+  zod-to-json-schema@3.25.2(zod@4.6.5):
     dependencies:
-      zod: 4.5.4
+      zod: 4.6.5
     optional: true
 
   zod@3.25.76: {}
 
   zod@4.1.13: {}
 
-  zod@4.5.4: {}
+  zod@4.6.5: {}
 
   zwitch@2.0.4: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 9e4ee57f6..a480285cb 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -43,7 +43,7 @@ allowBuilds:
 pmOnFail: warn
 
 catalog:
-  '@mdn/browser-compat-data': 8.1.0
+  '@mdn/browser-compat-data': 8.1.1
   # run-local-ci (bin: local-ci, formerly published as @redwoodjs/agent-ci)
   # runs a repo's GitHub Actions workflows locally in Docker so a change can
   # be validated before it's pushed (see the `agent-ci` skill). dtu-github-
@@ -51,21 +51,21 @@ catalog:
   # transitive) so its version is uniform fleet-wide.
   '@ultrathink/acorn.rs.wasm': 0.1.1
   'ata-validator': 1.27.0
-  'brace-expansion': 5.0.9
+  'brace-expansion': 5.0.12
   'dtu-github-actions': 0.18.1
   # shadscan — shadcn UI audit CLI for the design skills (missing UI
   # fundamentals report). Exact-pinned; the whole package is younger than
   # the soak window, so it carries a minimumReleaseAgeExclude entry below.
   '@shadscan/cli': 0.17.0
   '@sinclair/typebox': 0.34.52
-  'ecc-agentshield': 1.4.0
+  'ecc-agentshield': 1.6.0
   'mcp-tada': 0.4.0
   'run-local-ci': 0.18.1
   # typebox 1.x — the unscoped rewrite of @sinclair/typebox. Both names are
   # pinned while the fleet migrates; the 0.x entry is deleted once no member
   # imports the scoped name. 1.3.10 is inside the 7-day soak, so it carries a
   # dated minimumReleaseAgeExclude entry above.
-  'typebox': 1.3.30
+  'typebox': 1.3.31
   '@socketregistry/packageurl-js': 1.5.3
   # -stable aliases: pnpm `overrides:` can't redirect a package's own
   # name when used INSIDE that same package — Node ESM treats it as a
@@ -89,14 +89,14 @@ catalog:
   '@types/node': 26.5.1
   '@types/semver': 7.8.0
   '@types/shell-quote': 1.7.5
-  'compromise': 14.16.0
+  'compromise': 14.17.0
   'cross-env': 10.1.0
   # fast-check — property-based testing for pure fleet-script logic (pin
   # derivation, version compare, config validation). Runs standalone in vitest.
   # published: 2026-07-08 (past 7-day soak). See .claude/skills/fleet/property-testing.
-  'fast-check': 4.9.0
+  'fast-check': 4.10.0
   'lru-cache': 11.5.2
-  'magic-string': 1.2.3
+  'magic-string': 1.4.1
   'markdownlint-cli2': 0.23.2
   'mdast-util-from-markdown': 2.0.3
   # GFM pair for render-faithful markdown parsing (tables, footnotes,
@@ -125,7 +125,7 @@ catalog:
   'oxfmt': 0.68.0
   'oxlint': 1.83.0
   'oxlint-tsgolint': 7.0.2001
-  'pastoralist': 1.13.0
+  'pastoralist': 1.13.2
   # parse5 — the HTML parser half of the markdown story. mdast hands raw HTML
   # back as an opaque `html` node (README `<picture>`/`<img>` blocks), so
   # attribute-level edits need parse5's per-attribute source locations to land
@@ -173,16 +173,16 @@ catalog:
   # platform-binary optionalDependencies, despite the monorepo's internal
   # workspace layout. dtu-github-actions is its GitHub-Actions parser, pinned
   # explicitly (not left transitive) so its version is uniform fleet-wide.
-  '@anthropic-ai/claude-code': 2.1.251
+  '@anthropic-ai/claude-code': 2.1.272
   # comptime 0.1.0 — Zig-inspired build-time evaluation for Rolldown/Vite.
   # Wraps comptime(() => expr) calls; the Rolldown plugin evaluates them at
   # build time and replaces the call site with the serialized literal result.
   # Use in rolldown.config.mts for any repo with a Rolldown build.
   # published: 2026-05-07 (26 days, past 7-day soak)
   'comptime': 0.1.0
-  'rolldown-plugin-dts': 0.28.4
+  'rolldown-plugin-dts': 0.28.5
   'svgo': 4.1.0
-  'vite': 8.2.2
+  'vite': 8.3.0
   'vitiate': 0.3.1
   '@vitiate/core': 0.3.1
 
@@ -227,8 +227,8 @@ catalog:
   '@octokit/rest': 22.0.1
   '@octokit/types': 14.1.0
   '@pnpm/dependency-path': 1001.1.10
-  '@pnpm/lockfile.detect-dep-types': 1100.0.21
-  '@pnpm/lockfile.fs': 1100.2.5
+  '@pnpm/lockfile.detect-dep-types': 1100.0.23
+  '@pnpm/lockfile.fs': 1100.2.7
   '@pnpm/logger': 1100.0.0
   '@sentry/node': 8.55.2
   '@socketregistry/hyrious__bun.lockb': 1.0.19
@@ -244,7 +244,7 @@ catalog:
   '@types/npmcli__arborist': 6.3.3
   '@types/npmcli__config': 6.0.4
   '@types/proc-log': 3.0.4
-  '@types/react': 19.2.18
+  '@types/react': 19.3.0
   '@types/which': 3.0.4
   '@types/yargs-parser': 21.0.3
   '@typescript/native-preview': 7.0.0-dev.20260510.1
@@ -253,7 +253,7 @@ catalog:
   aggregate-error: npm:@socketregistry/aggregate-error@^1.0.15
   ajv-dist: 8.17.1
   ansi-regex: 6.3.0
-  browserslist: 4.28.8
+  browserslist: 4.28.9
   chalk-table: 1.0.2
   cmd-shim: 7.0.0
   del-cli: 6.0.0
@@ -275,7 +275,7 @@ catalog:
   hpagent: 1.2.0
   https-proxy-agent: 7.0.6
   husky: 9.1.7
-  ignore: 7.0.7
+  ignore: 7.0.9
   indent-string: npm:@socketregistry/indent-string@^1.0.14
   is-core-module: npm:@socketregistry/is-core-module@^1.0.11
   isarray: npm:@socketregistry/isarray@^1.0.8
@@ -292,7 +292,7 @@ catalog:
   packageurl-js: npm:@socketregistry/packageurl-js@^1.5.0
   path-parse: npm:@socketregistry/path-parse@^1.0.8
   postject: 1.0.0-alpha.6
-  react: 19.2.8
+  react: 19.3.0
   react-reconciler: 0.33.0
   safe-buffer: npm:@socketregistry/safe-buffer@^1.0.9
   safer-buffer: npm:@socketregistry/safer-buffer@^1.0.10
@@ -308,14 +308,14 @@ catalog:
   trash: 10.1.1
   type-coverage: 2.30.1
   typedarray: npm:@socketregistry/typedarray@^1.0.8
-  undici: 6.28.0
+  undici: 6.28.1
   unplugin-purge-polyfills: 0.1.0
   wrap-ansi: 9.0.2
   xml2js: 0.6.2
-  yaml: 2.9.0
+  yaml: 2.9.1
   yargs-parser: 21.1.1
   yoctocolors-cjs: 2.1.3
-  zod: 4.5.4
+  zod: 4.6.5
   '@types/node-forge': 1.3.14
   node-forge: 1.4.0
 # pnpm v11 reads settings from this file; only auth/registry go in .npmrc.
@@ -536,7 +536,7 @@ overrides:
   '@socketsecurity/registry': 'catalog:'
   '@socketsecurity/sdk': 'catalog:'
   '@swc/core': '1.16.1'
-  'brace-expansion@>=4': '5.0.9'
+  'brace-expansion@>=4': '5.0.12'
   'chalk@>=5': '5.6.2'
   'es-define-property': 'npm:@socketregistry/es-define-property@1.0.7'
   'es-set-tostringtag': 'npm:@socketregistry/es-set-tostringtag@1.0.10'
@@ -548,9 +548,9 @@ overrides:
   'hasown': 'npm:@socketregistry/hasown@1.0.7'
   'iconv-lite': '0.7.3'
   'isexe@>=3': '4.0.0'
-  'js-yaml@>=5.0.0 <5.2.2': '5.4.1'
+  'js-yaml@>=5.0.0 <5.2.2': '5.4.2'
   'lru-cache@>=10': '11.5.2'
-  'magic-string': '1.2.3'
+  'magic-string': '1.4.1'
   'mime-db': '1.54.0'
   'mime-types@>=3': '3.0.2'
   'minimatch@>=3': '10.2.6'
@@ -569,7 +569,7 @@ overrides:
   'uuid': '11.1.1'
   'which': '7.0.0'
   'wrap-ansi@>=8': '9.0.2'
-  'yaml@2': '2.9.0'
+  'yaml@2': '2.9.1'
 
   # Repo-specific overrides below.
   # Dedup: @grpc/proto-loader 0.7 (dockerode direct) vs 0.8 (via @grpc/grpc-js,
@@ -610,7 +610,7 @@ overrides:
   'ansi-regex': '6.3.0'
   # The previous transitive 1.0.2 release failed the trust policy; 1.0.4 has
   # cleared the seven-day soak and restores the normal no-downgrade gate.
-  'ast-v8-to-istanbul': '1.0.5'
+  'ast-v8-to-istanbul': '1.0.6'
   'brace-expansion': 'catalog:'
   # Dedup: color-convert 0.5.3 is a declared-but-unused dependency of
   # css-color-converter@2.0.0 (badge-maker) — its lib/index.js never
@@ -645,16 +645,16 @@ overrides:
   # on signal-exit v4 natively — the very mismatch the old execa@2 patch
   # existed to shim, so that patch retires with this collapse.
   'execa': '10.0.1'
-  'fast-uri': '>=4.1.3'
+  'fast-uri': '>=4.1.5'
   'form-data': '>=4.0.6'
   'globalthis': 'catalog:'
   'graceful-fs': 'catalog:'
   'has-property-descriptors': 'catalog:'
   'has-proto': 'catalog:'
-  'hono': '>=4.13.5'
+  'hono': '>=4.13.8'
   'https-proxy-agent': 'catalog:'
   'indent-string': 'catalog:'
-  'ip-address': '>=10.7.0'
+  'ip-address': '>=10.7.1'
   'is-core-module': 'catalog:'
   'is-interactive': 'npm:@socketregistry/is-interactive@1.0.6'
   'is-unicode-supported': 'npm:@socketregistry/is-unicode-supported@1.0.5'
@@ -662,7 +662,7 @@ overrides:
   'json-stable-stringify': 'npm:@socketregistry/json-stable-stringify@1.0.14'
   'lodash': 'catalog:'
   # Dependabot transitive-advisory pin (soaked, semver-compatible).
-  'markdown-it': '14.3.1'
+  'markdown-it': '14.3.2'
   'npm-package-arg': 'catalog:'
   'packageurl-js': 'catalog:'
   'path-parse': 'catalog:'
@@ -674,7 +674,7 @@ overrides:
   # no longer reads an options override) is never hit — neither fast-glob nor
   # globby ever pass a `windows` option. Collapse unscoped to 4.0.4.
   'picomatch': '4.0.7'
-  'postcss': '>=8.5.26'
+  'postcss': '>=8.5.28'
   'protobufjs': '7.6.6'
   'qs': '>=6.16.0'
   'rolldown': 'catalog:'
@@ -755,7 +755,6 @@ patchedDependencies:
   # The patch restores `expand` as the default on each build separately;
   # patching one build leaves the other broken.
   # On a bump, regenerate via `pnpm patch brace-expansion` + `pnpm patch-commit`.
-  brace-expansion@5.0.9: patches/fleet/brace-expansion@5.0.9.patch
   # default-export interop (managed by socket-wheelhouse sync; do not edit):
   # v10's ESM build ships named exports only, so `import minimatch from
   # 'minimatch'` throws "does not provide an export named default". That is