fix(security): update vulnerable Cuabot dependencies

[0xjohnnydev]

Summary

Update Cuabot packages that GitHub marked as vulnerable.

Why

The new alerts affect request handling, URL parsing, and image processing dependencies used by Cuabot.

What changed

• Update Hono to 4.12.27.
• Update @hono/node-server to 2.0.5.
• Update fast-uri to 3.1.4.
• Update Sharp to the patched 0.35 release line.

Definition of Done

• Alerts fix(lume): use partial search term for Remote Login in System Settings #966-feat(agent): add streaming support for Anthropic models #970 and feat(cd): add workflow to build QEMU golden images on EC2 #978-refactor(lume): enable SSH via System Settings UI instead of Terminal #980 use patched versions.
• The lockfile matches the package rules.
• TypeScript compilation succeeds.
• Sharp loads and reports version 0.35.3.
• GitHub confirms the alerts are closed after merge.

Test plan

• pnpm install --frozen-lockfile --ignore-scripts
• pnpm build
• Import Sharp and confirm its runtime version.

Supersedes Dependabot PRs #1463, #1847, and #2423.

[github-actions]

📦 Publishable packages changed

• npm/cuabot

Add release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.

[0xjohnnydev]

Superseded by #2719, which carries the current Cuabot security resolutions and validates the full package graph. Closing this older split PR so review stays on the canonical dependency draft.