chore(deps): override vulnerable transitive npm deps in harness and e2e

@rocicorp/zero 1.10.0 stays pinned as the oracle. npm overrides lift the
OpenTelemetry SDK, exporter and auto-instrumentations, tinypool (via oxfmt)
and uuid (via cloudevents) to patched releases. Clears all 26 Dependabot
alerts; npm audit reports 0 vulnerabilities in both directories.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Author: jnsdls