fix(security): refresh JavaScript dependency graphs

[0xjohnnydev]

Problem

The non-docs JavaScript graphs currently account for 38 open Dependabot alerts. This is the Cuabot, shared TypeScript, and agent-SDK example part of #2719.

There are no application-source changes in this PR.

What changed

• Updated Cuabot's Sharp, Hono server, brace-expansion, fast-uri, Hono, ip-address, and tar resolutions.
• Updated the shared TypeScript workspace's nanoid and PostCSS resolutions.
• Updated the CUA Driver agent-SDK example's Hono server, fast-uri, Hono, and ip-address resolutions.

Definition of Done

• Represent all 38 currently open alerts in these JavaScript graphs. Every affected manifest or lockfile is included and resolves outside the published vulnerable ranges.
• Preserve reproducible installs. Cuabot, shared TypeScript, and the agent-SDK example accept clean installs from their committed locks.
• Leave no known dependency advisory in these graphs. Their package-manager audits return no known vulnerabilities.
• Check the maintained build and test surfaces. Cuabot and shared TypeScript build, and the shared TypeScript tests pass.
• A maintainer confirms the Node 20 minimum. @hono/node-server 2.0.10 requires Node 20 or newer; the previous resolution supported Node 18.
• Current-head GitHub Actions pass. All repository Actions triggered by this split pass.
• GitHub confirms alert closure after merge to main. A draft PR cannot prove final Dependabot closure.

Known limit

The agent-SDK example still fails typechecking on removed ActionTarget APIs. The same errors reproduce on current main; this dependency-only PR does not change or hide them.

Split provenance

This contains the remaining non-Fleet JavaScript files from #2719, unchanged, rebuilt on current main.

[github-actions]

📦 Publishable packages changed

This comment is status-only. Editing it or adding task-list checkboxes cannot authorize a release.
Only owner-applied release:<service> labels can do that.

• ⏸️ npm/cuabot — no owner-authorized release label

Ask the release owner to apply release:<service> labels to auto-release on merge (+ optional bump:minor or bump:major, default is patch).
Or add no-release to skip.