chore: update dependencies and verify supported Node runtimes in CI

[steipete]

What Problem This Solves

The CLI declares Node 22 support, but CI tested only Node 26 and used Node 26 typings. Several dependencies and security/deployment actions had newer eligible releases, and some workflows still referenced mutable action tags.

User Impact

Runtime support remains Node 22 or newer. CI now tests and runs the installed package on Node 22, 24, and 26, while preserving the Windows process-execution checks.

Why This Change Was Made

Update Zod to 4.6.2, pnpm to 11.26.0, Oxfmt to 0.67.0, Oxlint to 1.82.0, and the Vite override to 8.3.0. Align Node typings to 22.20.2. Pin all remaining action references to verified commit SHAs, update CodeQL to 4.38.0 and Pages deployment to 5.0.1, and bound CI jobs with PR cancellation for superseded runs. Existing permissions and security checks remain in place.

All chosen releases are older than 48 hours. Zod 4.6.3 was intentionally deferred because it was published on September 12 at 22:23 UTC; 4.6.2 was published September 10 at 21:44 UTC. The pnpm minimum release age remains 2880 minutes. No package version bump or runtime-floor change.

Evidence

• pnpm install --frozen-lockfile succeeds with pnpm 11.26.0 and its supply-chain policy verification.
• actionlint passes. GitHub tag/ref queries resolve every new action pin, including the annotated CodeQL release tag.
• pnpm audit --json: zero vulnerabilities at every severity.
• pnpm typecheck, pnpm lint, pnpm format:check, pnpm test, pnpm build, and pnpm website:smoke passed: 941 passed / 2 existing platform skips.
• Live installed-package proof: pnpm pack:smoke maps 13 mixed-language features, including 3 CUDA.
• pnpm 12 was evaluated and deferred due to Dependabot #15904: its leading environment lock document hides the project graph from GitHub parsing. The final pnpm 11.26.0 lockfile is single-document; dependency-review coverage is preserved.
• Final isolated Codex autoreview: scoped-clean at P0–P2. Repeated frozen install, build, format check, actionlint, and installed-package proof with pnpm 11.26.0.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore: update dependencies and verify supported Node runtimes in CI This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.