Fix September 2026 security findings

[jmgasper]

Summary

• Remediates every open critical, high, and medium Dependabot alert with fixed nanoid, js-yaml, brace-expansion, fast-uri, Hono, valibot, and deepmerge-ts releases.
• Moves local and container execution to Node.js 26.5.1.
• Uses an Alpine 3.24 production stage with upgraded OpenSSL 3.5.8, dynamically linked Node.js, no npm tooling, and a non-root UID 10001 runtime.
• Updates the documented Node.js prerequisite.

Validation

• pnpm lint
• pnpm build
• pnpm audit --audit-level=moderate: no known vulnerabilities
• pnpm test --runInBand: 13 suites and 142 tests passed
• pnpm test:external-client: 3 tests passed
• Production Docker build and runtime package inspection passed
• Trivy CRITICAL,HIGH,MEDIUM scan with unfixed findings ignored: zero findings
• AWS Inspector enhanced scan of security-verification-20260901-ff62a1b: zero active critical, high, or medium findings

Notes

GitHub code scanning had no open critical, high, or medium alerts when remediation began. The deployed tag 141 was intentionally not overwritten; deployment of this change is required to replace that existing image.