chore(deps): consolidate npm devDeps + paths-filter action bumps

[pacphi]

Summary

Consolidates the two open Dependabot dependency-bump PRs into a single verified branch. Scope was deliberately limited to actual dependency bumps — #165 (opencode bug fix) and #131 (host-adapter ADR proposal, still under active review) are unrelated PRs and are left open/untouched.

Superseded PRs

PR	Package(s)	Bump	Area
#164	@types/node, eslint (devDependencies)	@types/node 26.1.2 → 26.2.0, eslint 10.8.0 → 10.8.1	npm (lockfile-only — both within existing caret ranges ^26.1.1 / ^10.7.0, so package.json is unchanged)
#163	dorny/paths-filter	v3 → v4	GitHub Actions (.github/workflows/devcontainers.yml)

Pre-existing fixes

None required — the full gate was already green prior to these bumps; no upgrade-caused or pre-existing breakage was found.

Security audit

• pnpm audit --audit-level=moderate → no known vulnerabilities.
• gh api repos/pacphi/agentic-kit/dependabot/alerts → 0 open alerts.
• No RUSTSEC/GHSA/CVE research was needed since no findings were surfaced (this repo has no Rust/Cargo component — TypeScript/npm only, per request).

Verification

Ran the exact gate .github/workflows/ci.yml uses, plus the full test suite:

pnpm install --frozen-lockfile   # lockfile reproduces cleanly
pnpm run typecheck               # tsc -p tsconfig.json            -> clean
pnpm run lint                    # eslint .                        -> clean
pnpm run lint:md                 # markdownlint-cli2 (61 files)    -> 0 issues
pnpm run build                   # scripts/build-check.mjs         -> OK (148 files, CLI loads, npm pack resolves 173 files)
pnpm test                        # node --test + all *.test.cjs    -> all suites passed, 0 failed
pnpm run test:surface            # dispatch-surface tests          -> 26 passed, 0 failed
pnpm run audit                   # pnpm audit --audit-level=moderate -> no known vulnerabilities

No Rust/Cargo steps applicable — this is a pure TypeScript/pnpm repository (no Cargo.toml).

🤖 Generated with Claude Code