chore(cli): bump dev-mostly dependencies flagged by pnpm audit

[blafourcade]

Problem

pnpm audit reports 12 findings. Eleven are dev-only or dev-server-only exposure (not reachable from anything this CLI ships to users); one (fast-uri, tracked separately in #463) is production-reachable.

What to bump

• vitest/@vitest/coverage-v8 → ^4.1.10 — clears the vite advisories (GHSA-fx2h-pf6j-xcff high, 2 moderate) and the esbuild advisory transitively pulled through vitest>vite>esbuild
• tsup → latest — clears the esbuild advisory pulled through tsup>esbuild (GHSA-g7r4-m6w7-qqqr)
• @commitlint/cli → ^21.2.1, @commitlint/config-conventional → ^21.2.0 — clears two js-yaml quadratic-DoS advisories (GHSA-52cp-r559-cp3m high, GHSA-h67p-54hq-rp68 moderate)
• @stryker-mutator/core/@stryker-mutator/vitest-runner → latest ^9.x — clears the brace-expansion regex-DoS advisory (GHSA-3jxr-9vmj-r5cp, two separate resolved ranges) and a @babel/core low-severity advisory

All are devDependencies; none of this ships in dist/cli.js (tsup.config.ts sets skipNodeModulesBundle: true).

Fix

Bump the four package groups above, run pnpm install, pnpm test, pnpm audit to confirm the 11 dev-only findings clear.

Acceptance criteria

• pnpm audit no longer reports the vitest/vite, esbuild, commitlint/js-yaml, or stryker/brace-expansion advisories
• pnpm test and pnpm test:mutation still pass after the bump

Found by a dependencies audit of cli/ — full report: cli/aidd_docs/tasks/2026_07/2026_07_22_audit/dependencies.md.