deps: collapse to a single Zod instance — blocked on @ag-ui/core hard ^3 and kvdex

[rickylabs]

Split from #1295, which was rescoped once the real blockers were measured with deno why npm:zod@3.25.76.

#1295 lands what is achievable now: the AI/MCP peer cluster onto npm Zod 4, workspace Zod in the root catalog, and a guard test that fails CI on a split graph. This issue is the part that cannot be done yet.

Why it is blocked

• @ag-ui/core@0.0.52 hard-depends on zod: ^3.22.4 — no || ^4, so it is unsatisfiable by Zod 4 at any version we can choose.
• jsr:@olli/kvdex@3.6.7 also materialises Zod 3, and 3.6.7 is the latest release.

Two possible routes, neither acceptable for 0.0.5:

1. TanStack AI 0.39 → 0.43 coordinated cluster upgrade. Currently pulls a canary AG-UI build — that trades a type-identity split for a pre-release dependency, which is a worse position for a release cut.
2. kvdex: replace, fork, remove, or an explicitly accepted compatibility override.

Watch signals

• @ag-ui/core publishes a stable release accepting zod ^4
• TanStack AI ships a stable line whose adapters do not require canary AG-UI
• kvdex publishes past 3.6.7 with Zod 4 support, or we decide to replace it

Acceptance

• deno info shows exactly one Zod instance across the whole graph
• npm:zod@3 absent from deno.lock
• deps: eradicate Zod 3 and align Zod on npm — three Zod instances coexist and npm peers requiring ^4.0.0 resolve to 3.25.76 #1295's guard test tightened from "no new split" to "no split at all"

Why it matters (from #1278): a schema built with one Zod instance is a different module identity from another — instanceof fails, brand checks fail, structurally identical types stop being assignable. That is the class that produced #1250 and #1249.