deps: batch update 7 dependencies

[wesm]

Consolidates the following dependabot updates:

• build(deps): bump github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0 #583 -- bump github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0
• build(deps): bump @lucide/svelte from 1.3.0 to 1.17.0 in /frontend #584 -- bump @lucide/svelte from 1.3.0 to 1.17.0 in /frontend
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 #585 -- bump actions/checkout from 6.0.2 to 6.0.3
• build(deps): bump dompurify from 3.4.7 to 3.4.8 in /frontend #586 -- bump dompurify from 3.4.7 to 3.4.8 in /frontend
• build(deps-dev): bump vitest from 4.1.7 to 4.1.8 in /frontend #587 -- bump vitest from 4.1.7 to 4.1.8 in /frontend
• build(deps): bump @tanstack/virtual-core from 3.16.0 to 3.17.0 in /frontend #588 -- bump @tanstack/virtual-core from 3.16.0 to 3.17.0 in /frontend
• build(deps-dev): bump svelte-check from 4.5.0 to 4.6.0 in /frontend #589 -- bump svelte-check from 4.4.8 to 4.5.0 in /frontend

The frontend lockfile overlap between #588 and the other npm bumps was resolved by keeping the newer version of each dependency.

Closes #583, #584, #585, #586, #587, #588, #589

🤖 Generated with Claude Code

[roborev-ci]

roborev: Combined Review (dfaa756)

Dependency bumps are incomplete: frontend installs will fail, and Go module metadata needs updating.

High

• frontend/package.json:18: Frontend dependency versions changed, but frontend/package-lock.json was not updated. Because the repo uses npm ci, CI/release/Docker installs will fail when the lockfile no longer matches package.json.
  • Fix: Regenerate and commit frontend/package-lock.json.

Medium

• go.mod:10: github.com/jackc/pgx/v5 was bumped to v5.10.0, but matching go.sum checksum entries are missing. Clean checkouts using readonly module mode may fail, and Go commands may mutate tracked files to repair module metadata.
  • Fix: Run go mod tidy or go mod download github.com/jackc/pgx/v5@v5.10.0 and commit the resulting go.sum changes.

---

Panel: ci_default_security | Synthesis: codex, 8s | Members: codex_default (codex/default, done, 2m16s), codex_security (codex/security, done, 15s) | Total: 2m39s