chore: clear high-severity dependency advisories

[aryamthecodebreaker]

What changed

• Upgrade Next.js and eslint-config-next from 16.2.10 to 16.2.11.
• Override Sharp to 0.35.3 and fast-uri to 3.1.4, pulling patched libvips/platform artifacts.
• Pin the tested MCP SDK release at 1.29.0.
• Add audit:production to CI with --audit-level=high, so high or critical production advisories block every PR and release.
• Bump coordinated release metadata and the Action example to 0.6.2.

Security scope

This clears all high-severity production audit findings. npm still reports two moderate entries caused by the MCP SDK's transitive Hono HTTP static-file adapter. FixMap does not expose HTTP or static serving: its source imports only server/index.js, server/stdio.js, and protocol types, so that Windows path-traversal route is not reachable. Forcing the adapter's next major version through a workspace-only override would not protect npm consumers and could break the SDK; this PR documents the residual instead.

Validation

• clean npm ci
• npm run ci — green, including 119 tests, the new production audit gate, typecheck, lint, Next 16.2.11 build, Action metadata/bundle checks, smokes, internal evaluation, and 1,000-file benchmark
• node scripts/evaluate-external.mjs --gate --check-recorded — unchanged at 50% top-1, 83.3% top-3, 83.3% top-5
• npm pack dry-runs — correct CLI/core 0.6.2 artifacts
• source reachability scan confirms no Hono, HTTP server, static serving, or Streamable HTTP imports
• git diff --check — clean