Resolve dependency security alerts

[nicu-chiciuc]

Why

GitHub reports six dependency alerts on the public starter, including one high-severity undici
alert. A public template must not copy known vulnerable transitive versions into new apps.

Summary

• Pin transitive undici to 7.29.0.
• Pin transitive @hono/node-server to 2.0.10.
• Regenerate the lockfile so the vulnerable versions are absent.

Validation

• vp install
• Frozen lockfile install
• pnpm audit
• vp run check
• vp run build
• vp run deploy:dry-run
• MCP streamable HTTP import with @hono/node-server@2.0.10

First Message

ok, do step 1 and 2 I guess, we'll need to step before step 3 to discuss

Requested Codex Runtime

Codex desktop default runtime.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}