fix(deps): close the October 2026 security alerts

[KeepLost]

Summary

Closes the eight open Dependabot alerts (except sprintf-js, which has no patched release) and the one secret-scanning alert, and supersedes the open Dependabot PRs that touch the same packages.

Alert	Package	Severity	Handling
#110	@modelcontextprotocol/sdk < 1.31.0	high	floor ^1.31.0 in mcp-client and ssh, lock at 1.31.0
#109	sharp < 0.35.5	high	^0.35.5, plus SVG decoder blocked (below)
#104	compression < 1.8.2	high	^1.8.2
#103	@vue/server-renderer < 3.5.42	high (docs build only)	override vue: 3.5.42
#105	source-map-js < 1.2.2	high (build time only)	override source-map-js: 1.2.2
#107	smol-toml <= 1.8.0	medium (dev)	root ^1.9.0 and override 1.9.0 (the old 1.7.1 override would have kept Dependabot's bump from applying)
#106	katex < 0.18.2	low	^0.18.2 and override 0.18.2 (the 0.16 line from mermaid and micromark-extension-math has no patched release)
#108	sprintf-js <= 1.1.3	medium	no patched release; only reachable through the electron-builder packaging chain; to be dismissed as tolerable risk

Other changes:

• attachment-local blocks libvips' VipsForeignLoadSvg once per process in requireSharp. SVG is not an accepted attachment format, so untrusted bytes no longer reach librsvg even to be rejected. Pinned by a new case in image.spec.ts, written red first.
• Secret alert chore(deps): bump hono from 4.12.29 to 4.13.2 #1 was a Telegram-token-shaped test literal (fake, no real bot exists). Two tests now build the value at runtime; the alert is closed as used_in_tests.
• actions/download-artifact is v8 in the release, vendor release and Landlock release workflows, matching the Python workflows. Every call downloads by name or pattern, so the v5 by-ID path change does not apply.
• New Agent Note 2026-10-08-security-alert-round (with Chinese pair) and a sentence in the attachment-local README pair.

Dependabot PRs

Superseded and to be closed: #66 (MCP SDK 1.30.0, replaced by 1.31.0), #171 (download-artifact v7, replaced by v8). Dependabot closes #172 to #176 itself once this lands. #158, #59, #65, #81 and #159 are unrelated to the alerts and are handled separately.

Verification

• pnpm run build passes.
• Focused vitest: mcp, ssh/ssh, host/webserver, client/ui-primitives, attachment, fs/tool-fs, chat (113 files, 1859 tests) pass; scripts/ci-workflow.spec.ts passes.
• Leaf gates: verify-third-party-notices, verify-optional-dependency-imports, verify-dsh-package-licenses, verify-runtime-closure, constraints, knip, doc link/ref/pairing/note-format verifiers.
• oxlint on the changed TypeScript files passes.
• Not run locally by policy: website:build (covers the vue and katex overrides for the documentation site), test:coverage, and the Windows and macOS lanes; CI owns them.