chore(deps): remediate development test toolchain

[HomenShum]

The root development lock retained five affected package entries across seven advisories. This updates Vitest 3.2.6 to compatible 4.1.11, removes Tinypool through its owning dependency, and refreshes brace-expansion/source-map-js within their existing ranges. Production lock entries, Vite, overrides, configuration, source and tests are unchanged.

Validation:

• Reproducible installation and the same 117 scenario identities/assertions pass before and after, with zero skips.
• Typecheck, build, source tours and keyless frame/durable/SQLite smokes pass.
• Fresh full npm audit, including development dependencies: zero vulnerabilities. Exact published registry integrities match all 16 added/updated entries.
• Independent code review and simplification review approved the exact diff (SHA-256 861c7d7a65401381f18cffb91db23a44be0e9afffb9e9d4d46d5832044120795); the reviewer independently reran 67 scenarios, typecheck, tours and the installed-tree check.

Chai 6.2.2, std-env 4.2.0 and tinyrainbow 3.1.1 remain valid in their parent ranges. Earlier install/audit failures are preserved with the successful follow-up in the dependency changelog. Node 22 was exercised; Node 20/24 were not. The separate chat-template lock is outside this root-only patch. No provider calls, model-quality claim or deployment claim.

Model-refresh PR #15 remains untouched. Merge is gated on exact-head CI and the existing merge-green helper.