chore(deps): npm update, with two pins that would otherwise break the build

[VickyXAI]

npm update refreshed the semver-compatible range of every dependency and pruned a large amount of stale transitive lockfile state (net -1296 lines). @blockrun/llm moved 3.5.2 → 3.8.3, which includes this session's max_tokens guard fix.

Two packages had to be pinned — and both failures were invisible to npm test

This is the part worth reading. npm test runs the already-emitted dist/, so a tsc failure and a runtime resolution failure both sailed through the test gate while npm run build was exiting non-zero. I only caught them by checking the build exit code directly. A green npm test is not a green build.

@types/ws 7.4.7 → 8.18.1 (a major)

Under 8's types, import WebSocket from 'ws'; new WebSocket.Server(...) in src/serve/server.ts is a TS2339 — .Server became a named WebSocketServer export that does not exist in 7. Fixing the source binds it to one major or the other. Cleaner to pin the types: added @types/ws: ^7.4.7. It was an unconstrained transitive dep, which is exactly why update felt free to jump it a major.

@colbymchenry/codegraph 0.9.7 → 0.9.9

0.9.9 added an exports map exposing only "." and "./package.json". Franklin resolves the built-in MCP shim with require.resolve('@colbymchenry/codegraph/npm-shim.js') (src/mcp/codegraph.ts:40). Under the new map that subpath is no longer exported → resolution throws → getCodegraphServerConfig returns null → the built-in CodeGraph MCP server silently disappears. Pinned to exact 0.9.7.

Net package.json change

- "@colbymchenry/codegraph": "^0.9.7"   →   "0.9.7"     (block 0.9.9's exports map)
+ "@types/ws": "^7.4.7"                              (block the 8.x major)

Two lines, both defensive, both with a failing build behind them.

Verification

npm run build exits 0, tsc --noEmit clean, 640 pass. Checked the build exit code, not just the test result — that distinction is the whole point of this PR.