fix(deps): clear 24 Dependabot CVE alerts (aws/cdk, docs, examples)

[kylehounslow]

What

Clears 24 of the 29 open Dependabot alerts remaining after the #357 wave (PRs #358-361). Bumps or overrides the affected dependencies across aws/cdk, docs, docs/starlight-docs, and the three examples/* uv manifests.

This branch was rebased onto current main after #367 (astro 6.4.8 -> 7.1.1 in /docs) merged. That upstream bump cleared the docs astro and docs esbuild alerts on its own, so the count moved from 25/33 at branch time to 24/29 now. The docs change here is reduced to the sharp and esbuild overrides layered on top of astro 7.1.1; astro in /docs is left at main's 7.1.1.

Fix

Node packages:

• aws/cdk: aws-cdk-lib 2.260.0 -> 2.262.1 (aws-cdk CLI 2.1132 -> 2.1133 in lockstep for synth schema compat). Clears fast-uri GHSA-4c8g-83qw-93j6, GHSA-v2hh-gcrm-f6hx (fast-uri drops out of the tree entirely at 2.262.1) and esbuild GHSA-g7r4-m6w7-qqqr via a 0.28.1 floor.
• docs: sharp -> 0.35.3 (GHSA-f88m-g3jw-g9cj), esbuild -> 0.28.1. Both top-level overrides on top of astro 7.1.1 from main.
• docs/starlight-docs: astro 6.3.7 -> 6.4.8 (GHSA-2pvr-wf23-7pc7, GHSA-jrpj-wcv7-9fh9), sharp -> 0.35.3 (GHSA-f88m-g3jw-g9cj), postcss 8.5.15 -> 8.5.24 (GHSA-r28c-9q8g-f849), vite 7.3.3 -> 7.3.6 (GHSA-fx2h-pf6j-xcff, GHSA-v6wh-96g9-6wx3), svgo 4.0.1 -> 4.0.2 (GHSA-2p49-hgcm-8545), esbuild -> 0.28.1.

Python examples (uv manifests):

• idna -> 3.18 (GHSA-65pc-fj4g-8rjx) and starlette -> 1.3.1 (GHSA-82w8-qh3p-5jfq, GHSA-wqp7-x3pw-xc5r, GHSA-x746-7m8f-x49c, GHSA-86qp-5c8j-p5mr, and GHSA-jp82-jpqv-5vv3 which is patched at 1.3.0) across all three.
• weather-agent requires-python tightened 3.9 -> 3.10 to match the SDK floor and unblock re-lock.
• code-assistant uv.lock regenerated to repair a malformed typing-extensions entry that failed to parse.

Validation

• aws/cdk: npm run build (tsc) passes.
• docs / docs/starlight-docs: lockfiles resolve against manifests; docs lock is coherent with astro 7.1.1 (npm install --package-lock-only reports up to date).
• All three uv locks pass uv lock --check.

Resolved versions on branch: fast-uri gone from the aws/cdk tree; docs astro 7.1.1 + sharp 0.35.3 + esbuild 0.28.1; starlight-docs astro 6.4.8, vite 7.3.6, postcss 8.5.24, svgo 4.0.2, sharp 0.35.3, esbuild 0.28.1; idna 3.18 and starlette 1.3.1 in all three example locks.

Not fixed here (5 alerts)

• brace-expansion (aws/cdk, GHSA-3jxr-9vmj-r5cp + GHSA-mh99-v99m-4gvg): bundled inside aws-cdk-lib (inBundle: true), so a top-level override cannot reach it. Clears when aws-cdk-lib re-bundles brace-expansion >= 5.0.8. Upstream-gated.
• astro 7.x-only CVEs (docs/starlight-docs, GHSA-f48w-9m4c-m7f5, GHSA-7pw4-f3q4-r2p2, GHSA-4g3v-8h47-v7g6): patched only in astro 7.x, a major upgrade for starlight-docs. Tracked separately.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.62%. Comparing base (53be4f5) to head (9094c87).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #369   +/-   ##
=======================================
  Coverage   55.62%   55.62%           
=======================================
  Files           4        4           
  Lines         169      169           
  Branches       47       48    +1     
=======================================
  Hits           94       94           
  Misses         74       74           
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[kylehounslow]

duplicate of #370