npm overrides for transitive CVE bumps

Three moderate findings on main were blocking every non-bot PR's Security Tests stage. None of the affected packages are direct dependencies — they all flow through agentation-mcp → @modelcontextprotocol/sdk. Force-bumping via overrides was the cleanest fix.

The findings 3 moderate

Package	CVE / advisory	Was	Now
hono	GHSA-9vqf-7f2p-gf9v · bodyLimit() bypass on chunked / unknown-length requests GHSA-69xw-7hcm-h432 · hono/jsx unvalidated tag names → HTML injection	4.11.4	^4.12.18
ip-address	GHSA-v2v4-37r5-5v8g · XSS in Address6 HTML-emitting methods	10.1.0	^10.2.0
express-rate-limit	Indirectly vulnerable: depends on vulnerable ip-address	8.0.1–8.5.0	^8.5.1

What lands in package.json

{
  "devDependencies": {
    "agentation-mcp": "^1.2.0"
  },
  "overrides": {
    "hono": "^4.12.18",
    "ip-address": "^10.2.0",
    "express-rate-limit": "^8.5.1"
  }
}

Before vs. after

Before (CI red)

$ npm audit --audit-level=moderate
3 moderate severity vulnerabilities

[FAIL] test-npm-audit.sh (1s)
##[error]Process completed with exit code 1.

Every non-bot PR blocked
Dependabot's own PR #1621 also red
main is shipping vulnerable transitive deps

After (CI green)

$ npm audit --audit-level=moderate
found 0 vulnerabilities

  PASS: npm audit gate
  Total: 13  |  Passed: 13  |  Failed: 0
  All security tests passed

Audit clean across all 5 lockfile dirs (root, docs/site, src/hooks, src/mcp-server, orchestkit-demos)
PR #1622 + #1623 unblock for merge
#1621 (Dependabot) becomes redundant — can be closed or rebased to a no-op

Why `overrides` instead of bumping `agentation-mcp`?

agentation-mcp@1.2.0 is the latest published version, and the vulnerable deps come in via its @modelcontextprotocol/sdk dependency. Waiting for the upstream chain to publish a fix would leave us exposed indefinitely. overrides is the documented npm way to force a transitive dep to a safer version while keeping the rest of the tree resolution intact. The lockfile delta is 24 lines — no userspace contract changes.

Once this lands, dispatch claude-release-watch.yml to refresh the cc-watch snapshot PR with real features extracted via the now-working cc-triage step.