Upgrade dependencies and fix repository review findings

[sbroenne]

Summary

• Upgrade direct dependencies to the latest published versions, including TypeScript 7, Vite 8, React 19, Copilot SDK/CLI, Office.js types, and test tools. Update Node requirements and CI configuration.
• Fix latest-version compatibility for browser JSON-RPC, CLI-owned agents, ESM configuration, and Vite startup/build behavior.
• Harden local server access and keep MCP execution settings and credentials server-side.
• Replace executable PowerPoint slide-generation input with validated JSON slide specifications.
• Remove obsolete Squad files/workflows and skillpm references; retain CLI-owned plugin and skill management.
• Fix chat startup by sharing/caching MCP discovery, completing plugin setup before readiness, and allowing queued prompts to wait for genuine initialization. Clean up sessions created after browser disconnection.
• Fix Excel freeze/unfreeze on inactive worksheets while restoring the original active sheet. Maximize only the dedicated Windows E2E workbook.
• Fix packaged Electron server paths and unpack required runtime files. Preserve JavaScript initialization order across smaller production bundles; largest bundle is approximately 370 KB.
• Show the host-default agent (Excel, PowerPoint, or Word), explain that the header link documents CLI plugin management, and wrap composer controls in narrow panes instead of clipping.
• Add a conversation mode picker for Interactive, Plan, and Autopilot. New sessions explicitly start Interactive; mode changes are verified against the live session, failures are shown, and permission approvals remain enforced in Autopilot.
• Update related documentation and regression coverage. New conversations default to Claude Sonnet 5.5.

Verification

Latest commit, including the UI and Autopilot follow-up:

Check	Result
Browser UI, no retries	46 passed, including real Plan/Autopilot switches, an Autopilot response, reset to Interactive, and narrow-pane bounds
Integration, including live Copilot	569 passed across 49 files
Excel Desktop	232 passed; 4 pre-existing optional AI tests pending
PowerPoint Desktop	15 passed
Word Desktop	14 passed
Type checking	Passed
Lint	Passed; one pre-existing pivot-table warning remains
Production build	Passed; largest JavaScript file approximately 370 KB
Commit hooks	Passed; 561 tests

Earlier packaged runtime verification also passed: actual Electron-packaged server startup, all 44 browser tests then present, and 561 integration tests. The final follow-up was checked against the development server and a fresh production build; the packaged installer has not been rebuilt for that follow-up.

npm outdated --json returned {} after the dependency upgrade.

Scope and exclusions

Outlook validation was explicitly excluded by request. Its test configuration received the same ESM compatibility rename as the other hosts, but no Outlook host checks were run. Upstream Office certificate-chain security findings were intentionally left unchanged. The trusted local certificate now works.

PowerPoint slide generation now accepts structured JSON rather than executable JavaScript; prompts and host tests are updated together.

Please review and use Squash and merge.