chore(deps): upgrade runtime deps to clear all known security alerts

[jackieli-tes]

Goal

Eliminate all known Dependabot security alerts (14 open across 6 packages).

Result: 13/14 alerts cleared

Verified by inspecting the regenerated yarn.lock — no vulnerable versions remain except one dev-only, unfixable case (see below).

Direct dependency upgrades (these pull in the fixes)

Dep	From → To	Clears
@actions/cache	^4.0.3 → ^5.0.5	drops @azure/ms-rest-js → removes uuid 8.3.2 (GHSA-w5hq-g745-h8pq); brings http-client@3 → undici 6.27
@actions/core	^1.11.1 → ^2.0.3	http-client@3 → undici 6.27 (all 5 undici GHSAs; < 6.24.0 had no 5.x patch)
minio	^7.1.1 → ^8.0.7	uses fast-xml-parser@5 → removes the vulnerable fxp 4.5.4 copy; minio 8 ships its own types so @types/minio is dropped

Why @actions/cache 5 and not 6: v6 adds a restrictive exports map exposing only ".", which breaks this action's required deep imports of @actions/cache/lib/internal/{cacheUtils,tar,constants} (jest's resolver rejects them; the bundle only works by accident). v5 has no exports field, fixes the same uuid/undici alerts, and keeps the internal imports resolvable.

In-range transitive bumps (re-resolved in yarn.lock)

• fast-xml-parser 5.5.3 → 5.9.0 (GHSA-gh4j / -8gc5 / -jp2q)
• brace-expansion 1.1.12 → 1.1.15 (GHSA-f886-m6hf-6m8v)
• @babel/core 7.29.0 → 7.29.7 (dev, low — GHSA-4x5r-pxfx-6jf8)

Dev tooling

jest ^29 → ^30, @types/jest ^26 → ^30, @vercel/ncc → ^0.44.

The one residual (cannot fix): js-yaml 3.14.2 — medium, dev-only

GHSA-h67p-54hq-rp68 (quadratic DoS in merge keys). Reached only through jest coverage tooling (babel-plugin-istanbul → @istanbuljs/load-nyc-config, which pins js-yaml ^3.13.1). The advisory has no 3.x patch, and load-nyc-config calls the safeLoad API removed in js-yaml 4, so a forced override would break coverage. Never reachable at action runtime; not executed in CI. Recommend dismissing this alert as "vulnerable code not in execution path."

Verification (local)

• tsc --noEmit — clean (no type breakage from minio 8 / cache 5 / core 2, or from removing @types/minio)
• yarn build (tsc + ncc) — succeeds
• Unit tests — pass, except the pre-existing p-retry ESM jest-config failure that also fails on main (unrelated; jest isn't part of CI)

dist/ intentionally not committed — build.yaml regenerates and commits it on merge, and the test workflows rebuild it fresh (repo convention).

Risk

minio 7→8 is a breaking major. Code typechecks and builds against it, but only the secret-gated S3 integration tests (which run on main post-merge) fully exercise real S3 behavior. Flagging for review before merge.