deps(npm): update Vitest packages to v5 in lockstep

[Chris0Jeky]

Problem

The three Dependabot major-update PRs for Vitest, Vitest UI, and Vitest coverage cannot install independently. Each package peers against the corresponding Vitest version, so an isolated update makes npm ci fail with ERESOLVE before frontend tests run.

Change

Update all three packages to 5.0.0 together and regenerate package-lock.json.

This replaces #2770, #2771, and #2773. Keep those original PRs open until this replacement is independently reviewed and qualified. #2769 remains separate.

Verification

• npm ci passed, with existing engine/deprecation warnings and one moderate audit finding.
• Vitest 5.0.0 focused tests: 47 passed.
• git diff --check passed.
• npm run typecheck passed.

npm run build began but did not reach a terminal result before the shared resource ceiling was reported, so it is not claimed as verification and was not retried. A full frontend Vitest suite was not run because another active lane holds the resource slot.

Refs #2770
Refs #2771
Refs #2773

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T01:01:35.935689Z	ef62bab	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Chris0Jeky]

Independent Terra review, round 1, at ef62babbc4ed2627d5867371ffb89f61f44a664a against db102dcba25cc5f347f22b38ce13d00502948ed9: no confirmed CRITICAL/HIGH findings.

The reviewer checked the frozen checkout and package/lock diff. Vitest, coverage-v8 and UI resolve to exactly 5.0.0 with matching peers. Node 24.13.1 and Vite 8 satisfy their declared ranges; current Vitest/PWA configuration has no demonstrated compatibility defect. No additional install or test was run by the reviewer.

Supplied local evidence is npm ci and 47 focused tests. Hosted CI, production build and broad coverage proof remain merge gates; a clean source review does not stand in for them. The original three isolated Dependabot PRs remain open until this combined replacement qualifies.

[Chris0Jeky]

Control-path authority correction: ci/policy.v1.json explicitly includes frontend/taskdeck-web/package{,-lock}.json. Therefore, even after exact-head hosted CI and independent review complete, this PR is PARKED pending the maintainer own ADR-0066 SC-10 review. The original #2770, #2771, and #2773 PRs remain open until this replacement is authorized and merged.

[Chris0Jeky]

Exact-head hosted qualification is now terminal at ef62bab: CLEAN/SUCCESS, 0 pending checks, 0 failed checks, and 0 unresolved review threads. The independent review evidence remains recorded. Because this package and lockfile path is a ci/policy.v1.json control path, the PR stays PARKED pending the maintainer own ADR-0066 SC-10 review; the original #2770, #2771, and #2773 PRs remain open.