v1.18.0

What's Changed

• fix(ci): resolve high-severity audit failures (tmp, axios) by @natew in #713
• fix(vxrn): inject TAMAGUI_TARGET into native rolldown bundle defines by @natew in #714
• fix(vxrn): wrap dev native bundle in function scope to stop global var leaks by @natew in #715
• fix(test): target the actual bound port when a dev/prod server rebinds by @natew in #716
• Pin patched shell-quote by @natew in #717

Full Changelog: v1.17.11...v1.18.0