fix(ci): patch ws advisory and scope security audit to production deps

[VascoSch92]

Problem

The security CI job (.github/workflows/ci.yml) has been failing on every recent push to main (5/5 latest runs red) — independent of any code change. npm audit checks the dependency tree against npm's live advisory database, and newly-published advisories tripped both audit steps:

• ws 8.0.0–8.20.1 — high severity, GHSA-96hv-2xvq-fx4p (memory-exhaustion DoS). This is a production dependency (runtime WebSocket).
• js-yaml ≤4.1.1 — moderate, root of 18 dev-only advisories via jest → babel-plugin-istanbul → @istanbuljs/load-nyc-config → js-yaml@3.
• @babel/core ≤7.29.0 — moderate, dev-only.

Fix

1. npm audit fix (non-breaking, package-lock.json only): bumps ws 8.20.0 → 8.21.0, clearing the only production-dependency vulnerability, and realigns the jest 30.x lockfile entries with package.json (the lockfile had drifted to jest@30.3.0 vs. the declared ^30.4.2).
2. Scope the moderate audit to production deps (npm audit --audit-level=moderate --omit=dev). The 18 remaining moderate advisories are entirely dev-only test tooling. The blocker, js-yaml@3, is pinned by @istanbuljs/load-nyc-config@1.1.0 — long unmaintained, no version uses js-yaml 4.x — so no dependency bump (including npm audit fix --force) can resolve it, and it never ships to consumers. The second step (--audit-level=high --production) is unchanged, so production deps remain gated at both moderate and high.

Verification

• npm audit --omit=dev → 0 vulnerabilities
• Both CI audit gates pass locally (exit 0)
• npm run build ✅ · npm run lint ✅ (0 errors) · npm test ✅ 254/254

Scope note

This is a standalone CI-health fix, independent of #214 (the agent-server 1.24.0 → 1.29.0 pin bump). It's branched off main so it can merge on its own.