fix: remove vulnerable runtime dependency paths

[miguel-heygen]

Summary

A clean hyperframes install now resolves a zero-advisory runtime graph instead of reporting five “unfixable” npm advisories, including four high-severity paths. The patched floors are Hono Node Server 2.0.5, adm-zip 0.6.0, and Sharp 0.35.0; the Hono floor is applied consistently across CLI, engine, producer, and GCP Cloud Run.

The issue’s suggested direct bumps alone still left two high advisories because onnxruntime-node@1.23.2 independently requires adm-zip ^0.5.16. This pins ONNX Runtime to 1.21.1 as an interim security/compatibility choice: it has no adm-zip edge, loads on Node 22, and still ships all six macOS/Linux/Windows x64/arm64 bindings, including Intel macOS. Regression coverage locks both the clean dependency contract and the native-platform matrix.

Closes #2850.

Validation

• Packed consumer: npm audit reports 0 advisories and npm ls contains no adm-zip@0.5
• Real CPU background removal: valid 64×64 RGBA output through ONNX + Sharp
• Packed CLI: lint and browser check pass; 300-frame MP4 render validates successfully
• CLI: 2,215 tests pass; focused ZIP/Sharp/ONNX suite: 42 tests pass
• CLI, engine, producer, and GCP Cloud Run typechecks pass
• Hono lifecycle/static-server suites pass across CLI, engine, producer, and GCP
• Frozen Bun install and workspace-contract validation pass

Upstream tracking: microsoft/onnxruntime#30125

---