fix(deps): refresh the caido-mode lockfile so esbuild resolves 0.28.x (ENG-8861)

[briangreunke]

Summary

Clears BDSA-2026-14563 (high) in caido-mode. The advisory: esbuild 0.27.7 downloads its platform binary without an integrity check when NPM_CONFIG_REGISTRY is set. esbuild comes in through tsx. The existing "tsx": "^4.19.0" range already admits a fixed release, so only the lockfile was stale.

Changes

• capabilities/web-security/skills/caido-mode/package-lock.json (npm update tsx)
  • tsx 4.21.0 → 4.23.15
  • esbuild 0.27.7 → 0.28.2, plus all 26 @esbuild/* platform packages
  • Removes get-tsconfig and resolve-pkg-maps, which tsx 4.23 no longer uses
  • Every changed resolved URL points at registry.npmjs.org
• capabilities/web-security/capability.yaml: version 2.0.2 → 2.0.3

No package.json change and no overrides.

Acceptance evidence

• npm ci then npm ls esbuild in caido-mode → only tsx@4.23.15 -> esbuild@0.28.2
• grep -c '"version": "0.27' package-lock.json → 0
• npm test in caido-mode → 68/68 passed

Regression evidence

• just validate strict=true → 20 ok, 6 warn, 0 failed. Same as on base f1cffac (warnings are missing external tools such as nuclei and httpx).
• pre-commit run --files <changed paths> passed.
• Base: main@f1cffac. Head: 5487743.

Linear: ENG-8861

🤖 Generated with Claude Code

[briangreunke]

Automated agent review

Verdict: APPROVE (agent review, not a human approval)

• Base: main@f1cffac
• Head: 548774395446b20edbb4cfdeb720c9aaff1bf188

No blocking findings.

Validation (clean git archive copy of the head)

• npm ci: 0 vulnerabilities.
• npm ls esbuild: only tsx@4.23.15 -> esbuild@0.28.2. No 0.27.x entries in npm ls --all.
• npm test: 68/68 passed. npx tsx caido-client.ts --help prints usage.
• just validate strict=true: 20 ok, 6 warn, 0 failed. Same as base.
• CI: 5/5 passed.
• Diff stays in scope: only tsx, esbuild, @esbuild/*, the two dropped tsx deps, and the 2.0.3 version bump. All new resolved URLs point at registry.npmjs.org.

Non-blocking

• Outside this PR: the base lockfile already resolves @caido/sdk-client, @caido/sdk-shared, and semver from registry.npmmirror.com, not registry.npmjs.org. This PR doesn't change those entries.