Bumps `vitest` / `@vitest/mocker` 5.0.1 → 5.0.5 to address
GHSA-qxg6-89mg-rqv8 (code injection via unauthenticated manual mock
registration) and GHSA-xp26-3454-mjgp (Windows path traversal).
Dev-only, lockfile-only. Tests pass.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>