fix: remediate npm audit findings

[TGambit65]

Summary

• pin @appium/logger to 2.0.6 via an npm override to eliminate the remaining root browser-tool audit findings
• refresh the root package-lock.json with the patched dependency graph
• update the WhatsApp bridge lockfile to patched transitive versions

Verification

• ran hermes doctor -> All checks passed
• ran npm audit in the repo root -> 0 vulnerabilities
• ran npm audit in scripts/whatsapp-bridge -> 0 vulnerabilities

Notes

• the tinker-atropos submodule was initialized and installed locally to satisfy doctor, but that installation is environment state rather than a tracked repo change

[TGambit65]

Heads up: the PR's GitHub Actions workflows are currently in an action_required state rather than actually running. That usually means a maintainer needs to approve workflow execution for this fork PR before Tests / Docker Build / Supply Chain Audit can start. Once they’re approved and running, I’ll inspect any actual failures.

[teknium1]

Thanks for the contribution, @TGambit65! These npm audit findings were resolved by a maintainer in PR #8745, which merged on 2026-04-13 (the same day this PR was opened).

Running npm audit on current main confirms 0 vulnerabilities — the fix landed via a different approach (no @appium/logger override pin required).

Evidence:

• Commit 3636f6454 — fix: resolve npm audit vulnerabilities in browser tools and whatsapp bridge (PR fix: resolve npm audit vulnerabilities in browser tools and whatsapp bridge #8745, merged 2026-04-13)
• npm audit --json on main → {"total": 0} across all severity levels
• Current package.json overrides: only lodash: 4.18.1 — the @appium/logger pin from this PR was not needed

Closing as implemented on main. This is an automated hermes-sweeper review.