fix(deps): adopt TypeMCP 0.2.2 remediation

[sjungwon03]

Summary

Adopt the published @theorvane/type-mcp@0.2.2 consumer remediation in the runnable examples application.

• Replace the stale TypeMCP ^0.2.0 declaration / 0.2.1 lockfile with ^0.2.2 and lock 0.2.2.
• Remove the obsolete nested npm override: it was only a local workaround before TypeMCP published the consumer-enforceable dependency graph.
• Keep a focused test for the direct TypeMCP declaration and resolved SDK/Hono graph.
• Correct README security guidance and package version information.

Exact dependency graph

@theorvane/type-mcp@0.2.2 → @modelcontextprotocol/sdk@1.30.0 → @hono/node-server@2.0.12

Verification

• focused red test before the manifest update ✅
• lint, typecheck, format check, full tests (5/5) ✅
• all four runnable examples ✅
• production audit after clean install: 0 vulnerabilities ✅
• git diff --check ✅

Closes #6

[sjungwon03-ai]

Independent Review — APPROVE

Reviewed at exact HEAD a07f583 against dev.

Verdict: APPROVE — no blockers.

Verified

• Published remediation confirmed: npm registry shows @theorvane/type-mcp@0.2.2 as latest, published via GitHub Actions OIDC with SLSA provenance attestation. Its dependency contract exact-pins @modelcontextprotocol/sdk@1.30.0 and @hono/node-server@2.0.12.
• Direct dependency: package.json declares ^0.2.2; lockfile resolves to exactly 0.2.2 with matching integrity hash.
• Transitive graph: lockfile entries confirm @modelcontextprotocol/sdk@1.30.0 and @hono/node-server@2.0.12 — no nested or duplicate entries.
• Override removal correct: the old local overrides entry was a workaround for 0.2.0/0.2.1. With 0.2.2 declaring both transitive deps as exact-pinned direct dependencies, the upstream consumer contract enforces the graph. No overrides key remains in package.json or package-lock.json.
• README accuracy: boundary section now correctly describes the published remediation and states 'no local npm override'. Package listing updated from 0.2.0 to '0.2.2 or later within the 0.2.x range'.
• Test coverage: dependency-security.test.ts asserts direct declaration (^0.2.2) and both resolved lockfile versions (SDK 1.30.0, Hono 2.0.12). Old override assertion properly replaced.
• No scope creep: only 4 files changed (README, package.json, package-lock.json, test). Zero source/example changes.
• Exact-head CI: verify check-run completed/success on this exact SHA. Workflow covers lint, build, full test suite, all four runnable examples, and audit:prod.
• Threads: no open review comments or issue comments.

Reviewed by Hermes Agent (independent, GitHub-evidence-only)