deps: realign onnxruntime-node pin to @huggingface/transformers' 1.24.3 lockstep

[jonlwheat2-gif]

Fixes the last remaining red from run 32933234257 on release/v3.8.51 (base-red #11449). The other five failing areas in that run were already fixed on base by #11582, #11585, #11588 and #11593; the ONNX drift was not.

Root cause

#11440's production-group dependabot bump moved the root optionalDependencies + overrides pin for onnxruntime-node 1.24.3 → 1.27.0, but @huggingface/transformers@4.2.0 hard-pins onnxruntime-node: "1.24.3" in its own dependencies.

Upstream evidence (researched 2026-08-26)

• npm dist-tag latest = 4.2.0 (published 2026-04-22); next = stale 4.0.0-next.11. No release since April.
• Every published 4.x release pins onnxruntime-node 1.24.3 exactly (verified via npm view across all 4.x versions: 4.0.0, 4.0.1, 4.1.0, 4.2.0 → all 1.24.3). There is no released version to lockstep against at 1.27.x today.
• Upstream support for 1.27 exists only as two open, unmerged PRs against huggingface/transformers.js:
  • #1730 — "Bump onnxruntime-node to 1.27.0 to drop deprecated boolean transitive dependency" (exact 1.27.0; motivation: 1.24.3 pulls global-agent@^3 → deprecated boolean@3.2.0, while 1.27 moves to global-agent@^4)
  • #1731 — "deps: bump onnxruntime-node and sharp" (^1.27.0 + sharp ^0.35)
• Neither is merged or tagged as of this writing, so root cannot legally pin 1.27.x without breaking the single-copy/lockstep contract.

Corroborating detail: the transitive closure my regenerated lockfile restores (global-agent@^3 → roarr, matcher@3, semver-compare, sprintf-js, detect-node, es6-error, json-stringify-safe, boolean) is precisely the subtree upstream PR #1730 describes removing when it moves to 1.27 — independent confirmation that this tree belongs to the 1.24.3 pin.

When upstream merges #1730/#1731 and tags a release pinning 1.27.x, both packages must bump together in one commit — that is the whole point of the lockstep rule pinned by the guard tests below.

Why exact equality matters

onnxruntime-node ships a native library (libonnxruntime.so.1 / .dll). If root says 1.27.0 while transformers pins 1.24.3, npm nests a second copy; two native libs under one SONAME cannot coexist in a process — the loader binds whichever dlopen()s first and the other addon dies with version 'VERS_1.27.0' not found. Dependabot made this same bump on 2026-08-16 and broke the Docker standalone build (documented in the header of tests/unit/onnxruntime-single-copy.test.ts).

The overrides entry masked the nesting by forcing a single hoisted copy at 1.27.0, so the single-copy guard kept passing, but it violated the lockstep contract pinned by:

• tests/unit/onnxruntime-single-copy.test.ts ("root onnxruntime-node matches the exact version @huggingface/transformers pins")
• tests/unit/build/optional-transformers-dependency.test.ts (optionalDependency pin == overrides pin == upstream's pin)

Fix

Reverts both root pins to 1.24.3 and regenerates package-lock.json. Lockfile resolves exactly one onnxruntime-node copy at exactly the version transformers.js declares, plus its matching transitive closure.

Diff footprint: package.json (2 lines) + package-lock.json (onnxruntime-node subtree only — every changed lock entry verified to belong to the onnxruntime closure).

Verification

node --import tsx/esm --test tests/unit/build/optional-transformers-dependency.test.ts tests/unit/onnxruntime-single-copy.test.ts
# 5/5 pass (3 previously red)

# lockfile audit
copies of onnxruntime-node: [node_modules/onnxruntime-node]
hoisted version: 1.24.3 == transformers pin 1.24.3

Note: npm run check:lockfile currently fails identically on pristine origin/release/v3.8.51 (pre-existing claude-agent-sdk URL-validation entries) — unrelated to and unchanged by this PR.

⚠️ base-red inherited: #11449

This diff touches only package.json (2 lines) + package-lock.json. Every failing job fails identically on pristine origin/release/v3.8.51 and is inherited, not introduced here:

• Unit Tests fast-path (1-4/4) — e.g. provider-translate-path-golden.test.ts "GOLDEN provider.ts translate-path is stable across all providers" reproduces on unfixed tip locally; likewise the live-ws/embedWsProxy port-binding tests, APIKEY_PROVIDERS merges ... 233 entries, and the credential-inventory classification checks. None read these manifests.
• Vitest (fast-path) — tests/unit/autoCombo/models-dev-tier-11508.test.ts: "No test suite found" on both branches (fixed separately by test(autoCombo): port models_dev_tier #11508 guard from node:test to vitest #11635).
• Docs Gates (fast-path) — same 7 STRICT drifts on both (provider count moved 353 → 354 in code; AGENTS.md, llm.txt, package.json description and hero/diagram SVGs still say "353"). Needs its own docs-sync fix PR.
• No new ESLint warnings — exits with "There are suppressions left that do not occur anymore" (config/quality/eslint-suppressions.json stale entries); pre-existing on tip, owned by fix(sse): explicit types for openai-responses pureHelpers — clears last failing core typecheck gate #11567.