[katsugtgz]

Updates adm-zip to 0.6.1 in sdk and server.

What and why

adm-zip 0.6.0 is covered by two advisories:

• GHSA-7q85-xj36-vmfc (published 2026-09-18): uncontrolled memory allocation via the declared uncompressed size
• GHSA-vwc7-r8mq-g2x9: path traversal when extracting specific zip files

Both sdk/package.json and server/package.json pinned adm-zip 0.6.0 as a runtime dependency. 0.6.1 is the fix version for both advisories; no other package pins changed.

How it was tested

• npm ci --ignore-scripts succeeds in both sdk/ and server/ against the updated lockfiles (integrity hashes verified by npm).
• The lockfile diffs touch only the four adm-zip fields (requirement, version, resolved URL, integrity); the nested node_modules/py/node_modules/adm-zip 0.5.18 copy of @bjia56/portable-python is pinned separately by that package and is out of scope here.

Note: 0.5.18 (the nested copy) is also in range for the same advisories, but it is locked by the parent package @bjia56/portable-python 0.1.141; bumping it needs a @bjia56/portable-python release, so this PR only clears the direct dependency.

Scope: sdk/package.json, sdk/package-lock.json, server/package.json, server/package-lock.json.