fix(ci): seed hooks consent in npm smoke test, resolve fresh audit advisories

Two independent CI failures on the PR:

- verify-npm-package spawns the packed CLI without a TTY, where the first-run
  consent gate now (correctly) skips hook installation — seed consent in the
  smoke HOME so the script keeps exercising the real install path, mirroring
  server/__tests__/cli.test.ts.
- npm audit gained fresh upstream advisories unrelated to this branch:
  brace-expansion and fast-uri (high, fixed in-range via lockfile) and the
  ajv@<=6.12.6 ReDoS under the dev-only AsyncAPI RAML parser chain (moderate,
  pinned to the patched ajv 6.15.0 via nested overrides — same major, so the
  parser API is untouched). asyncapi validate/generate verified drift-free.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: pablodelucca

package-lock.json

@@ -8,14 +8,19 @@
     "type": "git",
     "url": "https://github.com/pixel-agents-hq/pixel-agents"
   },
-  "workspaces": ["server", "webview-ui"],
+  "workspaces": [
+    "server",
+    "webview-ui"
+  ],
   "icon": "icon.png",
   "license": "MIT",
   "engines": {
     "node": ">=20",
     "vscode": "^1.105.0"
   },
-  "extensionKind": ["workspace"],
+  "extensionKind": [
+    "workspace"
+  ],
   "categories": [
     "Other"
   ],
@@ -159,7 +164,13 @@
   },
   "overrides": {
     "jsonpath-plus": "^10.4.0",
-    "brace-expansion": "^5.0.2",
-    "minimatch": "^10.1.1"
+    "brace-expansion": "^5.0.9",
+    "minimatch": "^10.1.1",
+    "json-schema-migrate": {
+      "ajv": "^6.15.0"
+    },
+    "webapi-parser": {
+      "ajv": "^6.15.0"
+    }
   }
 }

package.json

@@ -100,6 +100,14 @@ async function verifyInstalledTarball(tarballPath) {
   const smokeProject = path.join(smokeRoot, 'project');
   fs.mkdirSync(smokeHome, { recursive: true });
   fs.mkdirSync(smokeProject, { recursive: true });
+  // The spawned CLI has no TTY, and without prior consent the first-run gate
+  // (rightly) skips hook installation there — seed consent so the smoke test
+  // can exercise the actual install path (mirrors server/__tests__/cli.test.ts).
+  fs.mkdirSync(path.join(smokeHome, '.pixel-agents'), { recursive: true });
+  fs.writeFileSync(
+    path.join(smokeHome, '.pixel-agents', 'config.json'),
+    JSON.stringify({ hooksConsentGiven: true }),
+  );
   fs.writeFileSync(
     path.join(smokeProject, 'package.json'),
     JSON.stringify({ name: 'pixel-agents-package-smoke', private: true }, null, 2),