Pull in upstream t3code critical dependency fix (pingdotgg/t3code#33226) #426

Upstream t3code nightly v0.1.8-nightly.20261109.4429 includes fix(deps) pingdotgg/t3code#33226. Per that PR, the main lockfile had 69 dependency findings, 4 critical; it bumps DOMPurify, Sharp, stream-json, KaTeX and Undici, leaving 8 findings (0 critical, 2 high, 4 moderate, 2 low). No CVE IDs are named.

main doesn't have it yet. At the time of writing, the fork is 201 commits behind .4429 and 812 ahead.

Scope

• Bring the security bumps from fix(deps): update vulnerable dependencies and lockfile resolutions pingdotgg/t3code#33226 into s2code main, either as a targeted cherry-pick or as part of the full upstream catch-up.
• Note the risk: fix(deps): update vulnerable dependencies and lockfile resolutions pingdotgg/t3code#33226 is labeled Native Change, and the same upstream drop includes an Expo SDK 58 bump that may conflict in native files.
• Keep this separate from the fix(cursor): stop completed-answer replay on SDK 1.3.1 #422 fix-forward and 88f29f5d.

Done when

• The bumped versions of DOMPurify, Sharp, stream-json, KaTeX and Undici are in s2code's lockfile.
• A dependency audit shows 0 critical findings.
• Desktop, web and mobile builds and tests pass on the real branch.

Diff since the last tracked nightly: .4399...4429.