fix(security): patch agent SDK Hono server

[0xjohnnydev]

Problem

The Cua Driver agent-SDK examples resolve vulnerable transitive fast-uri, ip-address, and hono packages. The existing draft already fixes the related Hono server package.

What changed

• Keep @hono/node-server at 2.0.5.
• Add overrides for fast-uri 3.1.5, ip-address 10.3.1, and hono 4.12.34.
• Regenerate the example package-lock file.
• This draft covers current alerts OpenClaw gateway needs systemd，But it is not activated when starting with cuabot. #1074–fix(lume): remove com.apple.vm.networking from release entitlements #1075 and feat(lume): pending Apple entitlement for com.apple.vm.networking #1085–Lume documentation out of date #1087, plus the existing Hono server alert.

Definition of Done

• The agent-SDK lockfile resolves @hono/node-server 2.0.5, fast-uri 3.1.5, ip-address 10.3.1, and hono 4.12.34.
• Current agent-SDK alerts are mapped to this focused package-lock graph.
• The package-lock file matches the package manifest.
• A human confirms the Node 20 runtime floor and advances this draft; automation will not mark it ready or merge it.
• GitHub closes the alerts after the reviewed fix reaches the default branch.

Validation

• npm install --package-lock-only --ignore-scripts --no-audit --no-fund in libs/cua-driver/examples/agent-sdks.
• git diff --check.

Impact

This changes only the agent-SDK example dependency graph. No VM, installation, or live runtime proof was run on the host.

[0xjohnnydev]

This dependency graph is now included in draft #2719. That draft keeps each graph independently validated while giving reviewers one dependency-only change instead of several overlapping drafts. Nothing was merged or marked ready, and this branch is preserved.