chore(deps): bump JSR/npm minor+patch versions and promptfoo to 0.121.9

[stack72]

Summary

Refreshes dependencies flagged by the CI dependency-audit job:

• deno update bumps 24 deps within their existing ^ ranges (no major bumps):
  • JSR: @cliffy/command, @cliffy/table, @logtape/logtape, @logtape/pretty, @std/{assert,cli,fmt,fs,streams,yaml}
  • npm: @aws-sdk/client-cloudcontrol, @opentelemetry/{api,context-async-hooks,core,otlp-transformer,resources,sdk-trace-base,semantic-conventions}, @types/react, croner, fast-check, marked, react, zod
• evals/promptfoo bumped 0.121.7 → 0.121.9; lockfile regenerated. As a side effect this also clears the previously-dismissed transitive axios/uuid advisories from the lockfile itself.

cel-js (currently exact-pinned at 7.5.1) is intentionally left for a separate PR so the bump can ship with targeted CEL test coverage. Major bumps still pending — OTel 2.x set, croner@10, marked@18, fast-check@4, ink@7 — each warrants its own PR.

Test Plan

• deno check
• deno lint
• deno fmt --check
• deno run test (one flaky shutdown-handler test that passes in isolation, unrelated to deps)
• deno run compile + smoke ./swamp --version

[github-actions]

Code Review

Blocking Issues

None.

Suggestions

None — this is a clean, well-scoped dependency bump.

Summary: All 24 JSR/npm bumps are minor/patch within existing ^ ranges, no major version changes. The @cliffy/command specifier normalization from bare 1 to ^1.0.1 is a nice consistency improvement. cel-js is correctly left pinned for a separate PR. Lockfiles are regenerated consistently. CI passes on both Ubuntu and Windows. LGTM.