[theogravity]

Resolve the five new Seroval audit findings by updating 1.6.3 to 1.7.3. Update node-forge to 1.4.2, replacing our local backport and removing its audit exception. Deepmerge still has no fixed release; its tested local patch and documented exception remain.

Update all 22 hash-runner references to 5.0.0 and remove the glob override now that upstream ships glob 13.0.6. Add missing hash-runner configurations for assistant, grok-build, and oh-my-pi so their existing development build scripts work. Include a server and desktop-server patch changeset for the shipped Seroval fix.

Validation:

• bun run audit:deps: passes; only the patched deepmerge exception remains.
• Dependency security regression tests: 4 pass, including Forge rejection and valid Expo consumer behavior.
• Package synchronization and lockfile checks pass.
• Frontend build and type checks pass. Frontend suite: 3,127 passed; one file started before its build dependency was available, then all 20 tests in that file passed after the build completed.
• turbo run build:dev: all 43 tasks pass after adding the missing configurations.
• Isolated hash-runner CLI smoke check passes for initial execution, unchanged-input skip, changed-input rebuild, and --force.