fix(photon): close sidecar package advisories

[cermm]

Summary

• close the current-main-native Feature: Agent Mode System — Persona + Tool Scoping + Behavioral Constraints (inspired by Kilocode) NousResearch/hermes-agent#476 Photon sidecar package advisory gap
• update the sidecar override/lock graph for OpenTelemetry 2.10.0 / 0.221.0, protobufjs 8.7.1, and undici 7.29.0
• keep the change scoped to the Photon sidecar manifest and lockfile

Verification

• npm audit --package-lock-only --omit dev --audit-level=moderate --prefix plugins/platforms/photon/sidecar → 0 vulnerabilities
• npm ci --ignore-scripts --prefix plugins/platforms/photon/sidecar
• python3 -m pytest tests/ci/test_classify_changes.py -q -o addopts= → 21 passed
• python3 -m py_compile scripts/ci/classify_changes.py
• git diff --check
• git fsck --strict --no-dangling
• exact semantic/security review PASS/PASS for a7d98bd25e5adfb6bb0a5eac20397364f237e869

Boundaries

• no fix(config): route API keys and tokens to .env instead of config.yaml NousResearch/hermes-agent#469/fix: cross-platform orphaned process cleanup for WhatsApp bridge NousResearch/hermes-agent#472/Feature: Blackbox CLI Skill — Multi-Model Agent Delegation with Built-in Judge (inspired by Blackbox AI) NousResearch/hermes-agent#475/Feature: OpenHands Coding Agent Skill — Model-Agnostic Sandboxed Code Agent Delegation NousResearch/hermes-agent#477 gateway/session/approval changes
• no fix: use _max_tokens_param() in max-iterations retry summary NousResearch/hermes-agent#471/Feature: Study Deck Skill — Flashcard/Quiz Generation, Spaced Repetition & Progress Tracking (inspired by Studley.ai) NousResearch/hermes-agent#478 shared-auth migration or encrypted backup topology resurrection
• no Feature: Best-of-N Competitive Evaluation — Judge-Based Selection from Parallel Agent Outputs (inspired by Blackbox AI Chairman) NousResearch/hermes-agent#479 CI-authority stack replay

Refs: cermm/wc-infrastructure#476, parent cermm/wc-infrastructure#401