chore(deps): patch critical coverage and watcher dependencies

[infeng]

The lockfiles retain critical vulnerabilities in the coverage renderer, development WebSocket transport, and optional macOS watcher install chain. Update Handlebars 4.7.7 to 4.7.9 and websocket-driver 0.7.3 to 0.7.5 within their existing parent ranges. Update fsevents 1.x to 1.2.13 in both installs, removing its obsolete bundled node-pre-gyp/tar tree. Keep the existing fsevents 2.3.3 path.

This targets Dependabot alerts #297, #333, #144 and #340. Supporting dependencies are refreshed by npm as needed; application source, direct dependency ranges, webpack/Jest majors, and the package version are unchanged.

Validation:

• Clean public-registry npm ci --ignore-scripts and full npm run verify passed on Node 24: 42 tests, lint, library/demo/SSR builds, default-export and hydration checks, and package dry run.
• Faye WebSocket client/server echo passed with the updated driver.
• Both lockfiles contain no tar entry, all fsevents entries are 1.2.13 or 2.3.3, registry URLs are public-only, and git diff --check passed.
• The macOS-only native watcher was inspected in the lockfiles; its native runtime was not executed on this Linux host.

Advisories: Handlebars, websocket-driver, fsevents, tar.