chore(deps): bump npm minor patch group

[dependabot]

Summary

• Update the npm minor/patch dependency group.
• Bump @types/node from 24.13.2 to 24.13.3.
• Bump tsx from 4.23.0 to 4.23.1.

Governing Issue

No governing issue is linked; this is a Dependabot-managed patch dependency update.

Validation

• Fast checks are run by PR CI.

Bootstrap Governance

• The change is limited to development dependency metadata and its lockfile.
• No real secrets, runtime auth, or machine-local env files are committed.

Material change: no

Merge Automation

• Auto-merge is enabled with squash merge; independent review and required checks remain enforced.

Notes

• Dependabot will continue to own the dependency-update branch and can recreate it if upstream metadata changes.

[athena-omt]

Reviewed head e0866b6. Verified branch is fresh against main, diff is limited to package.json/package-lock.json dev dependency bumps for @types/node and tsx, and current-head CI Gate is green with dependency-only Fast Checks intentionally skipped. Local validation: npm ci --include=dev completed; npm run check reproduces the existing release-workflow guard failure on origin/main and is not introduced by this dependency bump. No unresolved review threads found.

[athena-omt]

Reviewed updated head c8e69a6 after syncing with main. Branch is fresh, current-head CI Gate is green, Fast Checks are dependency-only skipped by policy, and local npm run check now passes (62 tests) with dev dependencies installed via npm ci --include=dev. Diff remains limited to the @types/node and tsx dev dependency bump plus the main sync. No unresolved review threads found.

[athena-omt]

Reviewed final refreshed head 4bf3a4d after #83 and #67 merged. This head is fresh, but it is not mergeable: current-head Validate PR Governance and CI Gate fail. The failing governance log reports PRS-PR-TITLE-001 because the PR title is not Conventional Commit-style, and PRS-DCO-001 because the refreshed branch contains unsigned merge commits c8e69a6986d0 and 4bf3a4db08af. Repair handoff: rename the PR to a Conventional Commit title such as chore(deps): bump npm minor patch group, then recreate/rebase the Dependabot branch onto current main so every contributed commit carries a Signed-off-by trailer or have Dependabot regenerate the branch. Re-run CI after that; do not merge while this governance gate is red. Local note: the dependency-only content passed npm run check (62 tests) on the prior refreshed head, so the blocker is the current governance gate, not the package version changes themselves.

[athena-omt]

Reviewed current head 5a12ff93d1286cdeeb0d095ee0844b297a7c1fb8. The branch is fresh against main; all current-head CI/Governance and attestation checks succeeded, and auto-merge is enabled. The full diff is limited to the lockfile-consistent dev-dependency updates @types/node 24.13.2→24.13.3 and tsx 4.23.0→4.23.1. Local validation on this exact head passed: npm ci --include=dev and npm run check (typecheck plus 19 test files / 91 tests). No unresolved review threads found.